Implement Microsoft Account authentication for Azure DevOps with PAT fallback

package.json

@@ -43,7 +43,7 @@
         {
             "id": "microsoft",
             "scopes": [
-                "https://app.vssps.visualstudio.com/user_impersonation"
+                "499b84ac-1321-427f-aa17-267ca6975798/.default"
             ]
         }
     ],

src-tests/authenticationTest.ts

@@ -23,7 +23,7 @@ async function testAuthenticationImplementation() {
   // Check for Microsoft authentication implementation
   const hasMicrosoftAuth = funcString.includes("vscode.authentication.getSession") && 
                           funcString.includes("microsoft") &&
-                          funcString.includes("https://app.vssps.visualstudio.com/user_impersonation");
+                          funcString.includes("499b84ac-1321-427f-aa17-267ca6975798/.default");
 
   if (!hasMicrosoftAuth) {
     console.error("❌ Microsoft authentication implementation not found");
@@ -55,7 +55,7 @@ async function testAuthenticationImplementation() {
 
   // Check for user prompt options
   const hasUserPrompts = funcString.includes("Sign In") &&
-                        funcString.includes("Open Settings") &&
+                        funcString.includes("Configure PAT Token") &&
                         funcString.includes("showWarningMessage");
 
   if (!hasUserPrompts) {

src/azd/azDevOpsUtils.ts

@@ -66,28 +66,24 @@ export async function getAzureDevOpsConnection(orgUrl: string): Promise<azdev.We
   logInfo("Attempting Azure DevOps connection with Microsoft Account authentication");
 
   // Silently check for an existing Microsoft session — no UI prompt at this stage
-  const scopes = [
-    "499b84ac-1321-427f-aa17-267ca6975798/.default",
-    "https://app.vssps.visualstudio.com/user_impersonation"
-  ];
-  for (const scope of scopes) {
-    try {
-      const session = await vscode.authentication.getSession(
-        "microsoft",
-        [scope],
-        { createIfNone: false }
-      );
-      if (session) {
-        logInfo(`Microsoft authentication successful with scope '${scope}', using Bearer token`);
-        const authHandler = azdev.getBearerHandler(session.accessToken);
-        const connection = new azdev.WebApi(orgUrl, authHandler);
-        connection.connect();
-        logInfo(`Successfully created Azure DevOps connection using Microsoft Account for organization: ${orgUrl}`);
-        return connection;
-      }
-    } catch (error) {
-      logInfo(`Microsoft authentication not available with scope '${scope}': ${error}`);
+  try {
+    // 499b84ac-1321-427f-aa17-267ca6975798 is the well-known resource/app ID of Azure DevOps.
+    // The "/.default" suffix is required by the MSAL-based VS Code Microsoft authentication
+    // provider; the legacy "user_impersonation" scope is rejected as an invalid scope.
+    const session = await vscode.authentication.getSession(
+      "microsoft",
+      ["499b84ac-1321-427f-aa17-267ca6975798/.default"],
+      { createIfNone: false }
+    );
+    if (session) {
+      logInfo("Microsoft authentication successful (existing session)");
+      const authHandler = azdev.getBearerHandler(session.accessToken);
+      const connection = new azdev.WebApi(orgUrl, authHandler);
+      logInfo(`Successfully created Azure DevOps connection using Microsoft Account for organization: ${orgUrl}`);
+      return connection;
     }
+  } catch (error) {
+    logInfo(`Microsoft authentication not available silently: ${error}`);
   }
 
   // Fallback to Personal Access Token (PAT)
@@ -120,7 +116,7 @@ export async function getAzureDevOpsConnection(orgUrl: string): Promise<azdev.We
     try {
       const session = await vscode.authentication.getSession(
         "microsoft",
-        ["https://app.vssps.visualstudio.com/user_impersonation"],
+        ["499b84ac-1321-427f-aa17-267ca6975798/.default"],
         { createIfNone: true }
       );
 

src/azd/pullrequests/azDevOpsPullrequestFunctions.ts

@@ -34,10 +34,7 @@ export function StateMultipleAzDPrsInStream(
   searchQuery: string
 ) {
   stream.markdown(`🔍 Found ${pullrequests.length} pull request${pullrequests.length !== 1 ? 's' : ''} with title containing "${searchQuery}":\n\n`);
-  return await getAzureDevOpsConnection(orgUrl);
-}
 
-async function getAzureDevOpsConnection(orgUrl: string): Promise<WebApi> {
   pullrequests.forEach((pr, index) => {
     const statusText = (PullRequestStatus as any)[pr.status] || `Status ${pr.status}`;
     stream.markdown(`${index + 1}. 🔵**PR #${pr.pullRequestId}** [_${statusText}_]: **${pr.title}**\n`);