Does Rider provide a way to receive expiration warnings for Azure DevOps PATs while using least‑privilege scopes?

No, JetBrains Rider does not provide a native way to receive expiration warnings for Azure DevOps Personal Access Tokens (PATs), regardless of the scopes assigned to the token.

Current Behavior and Limitations

Rider utilizes a standard encrypted credential store to save PATs. This store treats the token as an opaque string; it does not store or track the metadata associated with the token, such as the creation date or the expiration timestamp provided by Azure DevOps during generation.

Because Rider does not proactively query the Azure DevOps API to validate the token's remaining lifespan, the following limitations apply:

• No Expiry Visibility: The credentials UI cannot display the expiration date because that data is not stored locally.
• Reactive Authentication: Rider only triggers a credential prompt after a remote operation (such as git fetch or a NuGet restore) fails with a 401 Unauthorized response.
• Scope Independence: Using least-privilege scopes does not change this behavior, as the IDE does not attempt to call the token management APIs that would be required to check expiration status.

Recommended Workflow for Token Maintenance

Since there is no built-in warning threshold, you must manage token rotation outside of the IDE to avoid workflow interruptions. To maintain least-privilege security while ensuring continuity, use these steps:

1. External Tracking: Set a calendar reminder or use an organizational secret manager to track the PAT expiration date.
2. Pre-emptive Rotation: Generate a new PAT with the minimum required scopes (e.g., Code (Read)) before the old one expires.
3. Manual Update: Update the token in Rider via Settings | Version Control | Git (or the corresponding credential helper) before the current token lapses.

Verification

To confirm your current configuration and the reactive nature of the prompts, you can perform these checks:

• Verify Storage: Navigate to Settings | Version Control | Git to see which credential helper is active.
• Test Failure: If you have a test token, allow it to expire and perform a git fetch. You will observe that Rider only prompts for a new token after the operation fails.

Diagnostic Detail Needed: Are you using the native JetBrains credential store, or is Rider delegating authentication to an external system helper (like Git Credential Manager)? If using an external manager, the warning behavior may be controlled by that tool rather than Rider.