Azure DevOps repeatedly forces users to sign in after successful Entra authentication

Problem description

Multiple users in our Azure DevOps Services organization have been intermittently forced out of the web portal for at least six months. On heavily affected days, basic actions such as changing a work item's status, posting a comment, or referencing another user can trigger another authentication cycle.

Microsoft Entra authentication succeeds, and other applications using the same Entra identities, including Teams and Outlook, remain signed in.

Environment

• Azure DevOps Services using Microsoft Entra ID for authentication
• Affected users are in different physical locations and use different local networks
• The problem occurs in both Chrome and Edge, although it occurs less frequently in Edge

What I've already tried

The available Entra sign-in events around the affected periods show Conditional Access as Not Applied. One precisely recorded forced-sign-out event did not appear in either the interactive or non-interactive Entra sign-in logs.

I also completely removed and recreated an affected user's Chrome profile. The forced-sign-out behavior continued afterward.

Four HAR traces were captured around repeated occurrences.

Findings from the HAR traces

The captures show the same general sequence:

1. Microsoft Entra authentication and OAuth token issuance complete successfully.
2. Azure DevOps subsequently returns multiple HTTP 401 responses.
3. Those responses contain x-tfs-forcesignout: true.
4. Their WWW-Authenticate header contains only Bearer and does not contain a claims= challenge.
5. Several reproductions also include HTTP 500 responses from the Azure DevOps /_signin endpoint.

Current status

We understand that a HAR trace alone cannot conclusively exclude a service-side Conditional Access or Continuous Access Evaluation event. We are looking for guidance on how to determine why Azure DevOps explicitly forces the session to sign out after successful Entra authentication.

The support request linked to this post contains the customer-specific details. Full HAR files, timestamps, user identifiers, and Azure DevOps Activity IDs are available for Microsoft through a private and secure support channel. We have intentionally omitted those details from this public post.