rcappello · rcappello · Jul 2, 2026 · Jul 2, 2026 · Jul 2, 2026
diff --git a/.specify/plans/002-pat-per-org-fallback.md b/.specify/plans/002-pat-per-org-fallback.md
diff --git a/.specify/plans/_backlog.md b/.specify/plans/_backlog.md
@@ -5,9 +5,10 @@ Features in pipeline. Each entry is a one-liner; promote to a full plan file
 
 ## Planned
 
-| ID  | Title                          | Status      | Plan                                       |
-| --- | ------------------------------ | ----------- | ------------------------------------------ |
-| 001 | Tree search / filter by name   | Approved    | [001-tree-search-filter.md](001-tree-search-filter.md) |
+| ID  | Title                                       | Status      | Plan                                       |
+| --- | ------------------------------------------- | ----------- | ------------------------------------------ |
+| 001 | Tree search / filter by name                | Done        | [001-tree-search-filter.md](001-tree-search-filter.md) |
+| 002 | PAT sign-in: per-organization fallback      | Draft       | [002-pat-per-org-fallback.md](002-pat-per-org-fallback.md) |
 
 ## Parking lot
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,12 @@ client folder:
 Entries below use the format `[client] message`, where `client` is `vscode`
 or `vs2026`.
 
+## [Unreleased]
+
+### Documentation
+
+- `[vscode]` `[vs2026]` Note the Azure DevOps global PAT retirement scheduled for 1 December 2026 ([aka.ms/GlobalPATDeprecation](https://aka.ms/GlobalPATDeprecation)): both READMEs now spell out that PAT sign-in currently requires the *All accessible organizations* scope and recommend Microsoft sign-in as the durable path. Multi-org PAT support after the retirement is tracked as plan 002.
+
 ## [0.3.0] - 2026-07-02
 
 - `[vscode]` `[vs2026]` **0.3.0** — **Filter by name.** New filter (title-bar icon and Command Palette in VS Code; filter box in the tool window in VS 2026) restricts the tree to pipelines, templates and scripts whose name contains a substring (debounced, case-insensitive). Before scanning, every organization / project / repository the signed-in identity can see is preloaded, and same-repo `template:` references are followed recursively (up to 10 levels deep, cycle-safe). Cross-repo aliases are skipped. YAML analysis is capped at 500 pipelines. Localized in all six languages. See plan 001 and the per-client CHANGELOGs.

diff --git a/src/vs2026/CHANGELOG.md b/src/vs2026/CHANGELOG.md
@@ -6,6 +6,12 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 > The VS Code client has its own changelog under [`src/vscode/CHANGELOG.md`](../vscode/CHANGELOG.md).
 
+## [Unreleased]
+
+### Documentation
+
+- Note in the README that PAT sign-in currently requires the *All accessible organizations* scope, and that Azure DevOps global PATs are retired on 1 December 2026 ([aka.ms/GlobalPATDeprecation](https://aka.ms/GlobalPATDeprecation)). Microsoft sign-in is recommended as the durable path; multi-org PAT support after the retirement is tracked as plan 002.
+
 ## [0.3.0] - 2026-07-02
 
 ### Added

diff --git a/src/vs2026/README.md b/src/vs2026/README.md
@@ -65,7 +65,7 @@ Pipelines
 2. Restart Visual Studio 2026 and open **View → Other Windows → Pipelines Explorer**.
 3. Choose a sign-in method:
    - **Sign in with Microsoft** — uses MSAL with the Windows WAM broker. Recommended for organizations connected to Microsoft Entra ID.
-   - **Sign in with Personal Access Token** — paste a PAT with at least `Code (Read)`, `Build (Read)` and `Project and Team (Read)` scopes. The PAT is persisted in Windows Credential Manager.
+   - **Sign in with Personal Access Token** — paste a PAT with at least `Code (Read)`, `Build (Read)` and `Project and Team (Read)` scopes, and **`All accessible organizations`** as *Organizations* scope so the tree can enumerate every org your account can reach. The PAT is persisted in Windows Credential Manager. See [PAT scope and the 1 Dec 2026 deprecation](#pat-scope-and-the-1-dec-2026-deprecation) below before you generate one.
 4. Browse organizations → projects → repositories → pipelines.
 
 A header row at the top of the tree shows the active connection (account name and, for Microsoft sign-in, the current tenant). Clicking the row — or the **organization** icon next to **Refresh** in the tool window toolbar — opens a tenant picker listing the Entra ID tenants your account belongs to, so you can switch tenant without signing out. The choice is persisted across restarts; **Reset all settings** clears it.
@@ -146,6 +146,30 @@ adapted to WPF Remote UI:
   `Strings.resx` under the `A11y_*` prefix and are translated through the
   same satellite assemblies as the rest of the UI.
 
+## PAT scope and the 1 Dec 2026 deprecation
+
+Pipelines Explorer discovers organizations by calling
+`https://app.vssps.visualstudio.com/_apis/accounts` — a *global* Azure DevOps
+endpoint. When you sign in with a Personal Access Token, that endpoint only
+works with a PAT whose **Organizations** scope is set to
+**All accessible organizations** (also called a *global PAT*). An
+organization-scoped PAT returns an empty list and the tree stays empty.
+
+Microsoft has announced the retirement of global PATs for Azure DevOps
+Services on **1 December 2026** ([aka.ms/GlobalPATDeprecation](https://aka.ms/GlobalPATDeprecation)).
+On that date every existing global PAT stops working and new ones can no
+longer be created. Azure DevOps *Server* is not affected.
+
+What this means for Pipelines Explorer:
+
+- **Until 1 Dec 2026** — PAT sign-in works as documented, provided you tick
+  *All accessible organizations* when you generate the token.
+- **Recommended today** — use **Sign in with Microsoft**. Entra-backed
+  sign-in is the durable path and is unaffected by the retirement.
+- **After 1 Dec 2026** — PAT sign-in will only be usable against a single
+  organization at a time. Support for per-organization PATs is tracked as
+  [plan 002](https://github.com/rcappello/PipelinesExplorer/blob/main/.specify/plans/002-pat-per-org-fallback.md).
+
 ## Requirements
 
 - Visual Studio 2026 (Community, Professional or Enterprise — `[18.0,)`).

diff --git a/src/vscode/CHANGELOG.md b/src/vscode/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to **Pipelines Explorer** are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Documentation
+
+- Note in the README that PAT sign-in currently requires the *All accessible organizations* scope, and that Azure DevOps global PATs are retired on 1 December 2026 ([aka.ms/GlobalPATDeprecation](https://aka.ms/GlobalPATDeprecation)). Microsoft sign-in is recommended as the durable path; multi-org PAT support after the retirement is tracked as plan 002.
+
 ## [0.3.0] - 2026-07-02
 
 ### Added

diff --git a/src/vscode/README.md b/src/vscode/README.md
@@ -62,7 +62,7 @@ Pipelines
 2. Open the **Pipelines Explorer** view in the activity bar.
 3. Choose a sign-in method:
    - **Sign in with Microsoft** — uses VS Code's built-in Microsoft account. Recommended for organizations connected to Microsoft Entra ID.
-   - **Sign in with Personal Access Token** — paste a PAT with at least `Code (Read)`, `Build (Read)` and `Project and Team (Read)` scopes.
+   - **Sign in with Personal Access Token** — paste a PAT with at least `Code (Read)`, `Build (Read)` and `Project and Team (Read)` scopes, and **`All accessible organizations`** as *Organizations* scope so the tree can enumerate every org your account can reach. See [PAT scope and the 1 Dec 2026 deprecation](#pat-scope-and-the-1-dec-2026-deprecation) below before you generate one.
 4. Browse organizations → projects → repositories → pipelines.
 
 A header row at the top of the tree shows the active connection (account name and, for Microsoft sign-in, the current tenant). Clicking the row — or the **organization** icon next to **Refresh** in the view title bar — opens a quick-pick listing the Entra ID tenants your account belongs to, so you can switch tenant without signing out. The choice is persisted across restarts; **Reset** clears it.
@@ -142,6 +142,30 @@ Pipelines Explorer follows the
   (e.g. *"YAML file not found in the repository."*) are translated through the
   same `vscode.l10n` bundles used for the UI.
 
+## PAT scope and the 1 Dec 2026 deprecation
+
+Pipelines Explorer discovers organizations by calling
+`https://app.vssps.visualstudio.com/_apis/accounts` — a *global* Azure DevOps
+endpoint. When you sign in with a Personal Access Token, that endpoint only
+works with a PAT whose **Organizations** scope is set to
+**All accessible organizations** (also called a *global PAT*). An
+organization-scoped PAT returns an empty list and the tree stays empty.
+
+Microsoft has announced the retirement of global PATs for Azure DevOps
+Services on **1 December 2026** ([aka.ms/GlobalPATDeprecation](https://aka.ms/GlobalPATDeprecation)).
+On that date every existing global PAT stops working and new ones can no
+longer be created. Azure DevOps *Server* is not affected.
+
+What this means for Pipelines Explorer:
+
+- **Until 1 Dec 2026** — PAT sign-in works as documented, provided you tick
+  *All accessible organizations* when you generate the token.
+- **Recommended today** — use **Sign in with Microsoft**. Entra-backed
+  sign-in is the durable path and is unaffected by the retirement.
+- **After 1 Dec 2026** — PAT sign-in will only be usable against a single
+  organization at a time. Support for per-organization PATs is tracked as
+  [plan 002](https://github.com/rcappello/PipelinesExplorer/blob/main/.specify/plans/002-pat-per-org-fallback.md).
+
 ## Requirements
 
 - VS Code **1.99.0** or newer.