Exact end-of-life dates for Azure DevOps OAuth and Global PATs — any extensions, and do they hard-stop?

Hi,

We build an integration with Azure DevOps that many customers use, and we're planning our move off two deprecated authentication methods. To plan the timeline and tell our customers about it, we need confirmed dates and behavior for both:

1. Legacy Azure DevOps OAuth (app registrations at app.vssps.visualstudio.com) → Microsoft Entra ID OAuth

• I understand that new Azure DevOps OAuth app registrations are no longer accepted, and that full deprecation is planned for 2026. I couldn't find an official final date. What is the exact date when existing Azure DevOps OAuth apps and the tokens they issue will stop working?
• Will there be an extension or a grace period, for example per organization or by request through support?
• At the cutoff, will it fail right away (token issuance and refresh both rejected), or will it be phased out gradually (for example, refresh tokens first, then access tokens)?

2. Global Personal Access Tokens (PATs scoped to "All accessible organizations")

• My understanding is that existing Global PATs stop working on December 1, 2026. Can you confirm that date?
• Is there any extension or opt-out, for example an organization or tenant policy that keeps them working longer?
• On that date, will existing Global PATs be rejected right away for all API calls, or will they be phased out (for example, by region or scale unit)? Will they show any warning or a specific error code beforehand that we can detect?

General

• Is there an official roadmap or blog post that lists the final dates for both? We'd like to link to it in our customer communication.

Thanks!