Build agent authentication with Azure AD user

Question

We have changed from TFS 2017 to Azure DevOps Services. In TFS we have used the AD to authenticate the users. For Azure DevOps Services we use a Azure AD. So I wanted to configure a self-hosted build agent on a on-premise machine. I tried it with PAT authentication and it works like expected. Just to see if it works i tried the other authentication types:

--auth <type> - authentication type. Valid values are:

pat (Personal access token) --> works
negotiate (Kerberos or NTLM) --> not working because of Azure AD authentication
alt (Basic authentication) --> ?
integrated (Windows default credentials) --> not working because of Azure AD authentication

I tried to authenticate with user name (email) and password of the user which i used to successfully authenticate with PAT. But everytime i get the message that the user is not authorized to access the server.

Could it be that it is not possible to authenticate a build agent with a user of Azure DevOps Services with his user name and password instead of PAT?

I had the same problem when I tried to authenticate with Azure DevOps Service via API. But there I could use VssAadCredential instead of VssBasicCredential.

Is there something like that for the build agent configuration or am I doing something wrong?

Answer 1

When registering the agent, and by using authentication type = Negotiate, the agent should use user name & password instead of PAT.