Azure DevOps repeatedly forces users to sign in after successful Entra authentication

Question

Azure DevOps repeatedly forces users to sign in after successful Entra authentication

John 0

Problem description

Multiple users in our Azure DevOps Services organization have been intermittently forced out of the web portal for at least six months. On heavily affected days, basic actions such as changing a work item's status, posting a comment, or referencing another user can trigger another authentication cycle.

Microsoft Entra authentication succeeds, and other applications using the same Entra identities, including Teams and Outlook, remain signed in.

Environment

Azure DevOps Services using Microsoft Entra ID for authentication
Affected users are in different physical locations and use different local networks
The problem occurs in both Chrome and Edge, although it occurs less frequently in Edge

What I've already tried

The available Entra sign-in events around the affected periods show Conditional Access as Not Applied. One precisely recorded forced-sign-out event did not appear in either the interactive or non-interactive Entra sign-in logs.

I also completely removed and recreated an affected user's Chrome profile. The forced-sign-out behavior continued afterward.

Four HAR traces were captured around repeated occurrences.

Findings from the HAR traces

The captures show the same general sequence:

Microsoft Entra authentication and OAuth token issuance complete successfully.
Azure DevOps subsequently returns multiple HTTP 401 responses.
Those responses contain x-tfs-forcesignout: true.
Their WWW-Authenticate header contains only Bearer and does not contain a claims= challenge.
Several reproductions also include HTTP 500 responses from the Azure DevOps /_signin endpoint.

Current status

We understand that a HAR trace alone cannot conclusively exclude a service-side Conditional Access or Continuous Access Evaluation event. We are looking for guidance on how to determine why Azure DevOps explicitly forces the session to sign out after successful Entra authentication.

The support request linked to this post contains the customer-specific details. Full HAR files, timestamps, user identifiers, and Azure DevOps Activity IDs are available for Microsoft through a private and secure support channel. We have intentionally omitted those details from this public post.

Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-09-01T17:12:47.6033333+00:00

Hi @John ,

This does not appear to be a normal Microsoft Entra authentication failure. The Entra authentication completes successfully, but Azure DevOps subsequently returns 401 responses with x-tfs-forcesignout: true, which indicates that the Azure DevOps session is being explicitly signed out.

Since the issue occurs across multiple users, different networks, and different browsers, and continues even after recreating the browser profile, a local browser or network issue appears less likely.

The 500 responses from the /_signin endpoint are also significant and may be related to the session being re-established after the forced sign-out.

However, the HAR traces alone are not sufficient to determine the exact reason Azure DevOps is invalidating the session. Please correlate the exact timestamps, Azure DevOps Activity IDs, and the 401/500 responses with the corresponding service-side events and provide over private messages.

Also, the absence of a corresponding Microsoft Entra sign-in event does not necessarily rule out an Azure DevOps session or token-validation event, as the forced sign-out can occur after the initial Entra authentication has already completed.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-09-03T01:55:08.46+00:00

@John ,following up to see if you had a chance to check my response and if it was helpful. Please let me know if you have any questions.
John 0 Reputation points

2026-09-03T16:28:19.5133333+00:00

Hi @Pravallika KV ,

Your first comment was useful in confirming this looks like Azure DevOps session invalidation after a successful Entra sign-in, not a primary Entra auth failure.

Because this thread is public, I cannot post timestamps, Activity IDs, identity mappings, or HAR details here.

Those artifacts are already associated with the linked support request. I can also send them through a private Q&A message or the support-request email thread.

Please continue the investigation on that private channel and escalate for Azure DevOps service-side correlation of the forced sign-out (x-tfs-forcesignout: true) and /_signin HTTP 500 responses.

Your answer

Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-09-01T17:12:47.6033333+00:00

Hi @John ,

This does not appear to be a normal Microsoft Entra authentication failure. The Entra authentication completes successfully, but Azure DevOps subsequently returns 401 responses with x-tfs-forcesignout: true, which indicates that the Azure DevOps session is being explicitly signed out.

Since the issue occurs across multiple users, different networks, and different browsers, and continues even after recreating the browser profile, a local browser or network issue appears less likely.

The 500 responses from the /_signin endpoint are also significant and may be related to the session being re-established after the forced sign-out.

However, the HAR traces alone are not sufficient to determine the exact reason Azure DevOps is invalidating the session. Please correlate the exact timestamps, Azure DevOps Activity IDs, and the 401/500 responses with the corresponding service-side events and provide over private messages.

Also, the absence of a corresponding Microsoft Entra sign-in event does not necessarily rule out an Azure DevOps session or token-validation event, as the forced sign-out can occur after the initial Entra authentication has already completed.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-09-03T01:55:08.46+00:00

@John ,following up to see if you had a chance to check my response and if it was helpful. Please let me know if you have any questions.
John 0 Reputation points

2026-09-03T16:28:19.5133333+00:00

Hi @Pravallika KV ,

Your first comment was useful in confirming this looks like Azure DevOps session invalidation after a successful Entra sign-in, not a primary Entra auth failure.

Because this thread is public, I cannot post timestamps, Activity IDs, identity mappings, or HAR details here.

Those artifacts are already associated with the linked support request. I can also send them through a private Q&A message or the support-request email thread.

Please continue the investigation on that private channel and escalate for Azure DevOps service-side correlation of the forced sign-out (x-tfs-forcesignout: true) and /_signin HTTP 500 responses.