TF30063: You are not authorized to access (401) Unauthorized.

[Stischu]

I have configured the tool with AccessToken in both the Source and Target, and they have been verified as correct. Upon attempting to execute the script, I encounter the following error (the Target in the URL has been redacted below). Everything should be in order with credentials and permissions, and are not able to figure out where the issue may be. Does anyone have insight on this?

`[14:17:02 INF] [v15.0.1] Beginning run of 1 processors
[14:17:02 INF] [v15.0.1] Processor: WorkItemMigration
[14:17:02 INF] [v15.0.1] Migration Context Start: WorkItemMigration
[14:17:02 INF] [v15.0.1] Connecting with AccessToken 
[14:17:03 ERR] [v15.0.1] Unable to configure store: Check persmissions and credentials for AccessToken
Microsoft.TeamFoundation.TeamFoundationServerUnauthorizedException: TF30063: You are not authorized to access https://dev.azure.com/Target. ---> System.Net.WebException: The remote server returned an error: (401) Unauthorized.
   at System.Net.HttpWebRequest.GetResponse()
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.SendRequestAndGetResponse(HttpWebRequest webRequest, WebException& webException)
   --- End of inner exception stack trace ---
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpWebRequest.SendRequest()
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpRequestChannel.Request(TfsMessage message, TimeSpan timeout)
   at Microsoft.TeamFoundation.Client.Channels.TfsHttpClientBase.Invoke(TfsClientOperation operation, Object[] parameters, TimeSpan timeout, Object[]& outputs)
   at Microsoft.TeamFoundation.Framework.Client.LocationWebService.Connect(Int32 connectOptions, Int32 lastChangeId, Int32 features)
   at Microsoft.TeamFoundation.Framework.Client.FrameworkServerDataProvider.Connect(ConnectOptions connectOptions)
   at Microsoft.TeamFoundation.Client.TfsConnection.EnsureProviderConnected()
   at MigrationTools._EngineV1.Clients.TfsMigrationClient.GetDependantTfsCollection(NetworkCredential credentials) in D:\a\1\s\src\MigrationTools.Clients.AzureDevops.ObjectModel\_EngineV1\Clients\TfsMigrationClient.cs:line 151

`
{
"ChangeSetMappingFile": null,
"Source": {
"$type": "TfsTeamProjectConfig",
"Collection": "https://dev.azure.com/Source",
"Project": "Project Source",
"ReflectedWorkItemIDFieldName": "Custom.ReflectedWorkItemId",
"AllowCrossProjectLinking": false,
"AuthenticationMode": "AccessToken",
"PersonalAccessToken": "123456789456123456789456123",
"PersonalAccessTokenVariableName": "Testmig1",
"LanguageMaps": {
"AreaPath": "Area",
"IterationPath": "Iteration"
},
"CollectionName": "https://dev.azure.com/Source"
},
"Target": {
"$type": "TfsTeamProjectConfig",
"Collection": "https://dev.azure.com/Target",
"Project": "Project Target",
"ReflectedWorkItemIDFieldName": "Custom.ReflectedWorkItemId",
"AllowCrossProjectLinking": false,
"AuthenticationMode": "AccessToken",
"PersonalAccessToken": "123456789456123456789456123",
"PersonalAccessTokenVariableName": "Testmig2",
"LanguageMaps": {
"AreaPath": "Area",
"IterationPath": "Iteration"
},
"CollectionName": "https://dev.azure.com/Target"
},
"FieldMaps": [],
"GitRepoMapping": null,
"LogLevel": "Information",
"CommonEnrichersConfig": [],
"Processors": [
{
"$type": "WorkItemMigrationConfig",
"Enabled": true,
"UpdateCreatedDate": true,
"UpdateCreatedBy": true ,
"WIQLQuery": "SELECT [System.Id] FROM WorkItems WHERE [System.TeamProject] = @teamproject AND [System.WorkItemType] IN ('Bug') AND [Microsoft.VSTS.Common.ClosedDate] = '' ORDER BY [System.ChangedDate] desc",
"FixHtmlAttachmentLinks": false,
"SkipToFinalRevisedWorkItemType": false,
"WorkItemCreateRetryLimit": 5,
"FilterWorkItemsThatAlreadyExistInTarget": true,
"PauseAfterEachWorkItem": false,
"AttachRevisionHistory": false,
"LinkMigrationSaveEachAsAdded": false,
"GenerateMigrationComment": true,
"WorkItemIDs": 21692,
"MaxGracefulFailures": 0,
"SkipRevisionWithInvalidIterationPath": false,
"SkipRevisionWithInvalidAreaPath": false
}
],
"Version": "15.0",
"workaroundForQuerySOAPBugEnabled": false,
"WorkItemTypeDefinition": {
"sourceWorkItemTypeName": "targetWorkItemTypeName"
},
"Endpoints": {
"InMemoryWorkItemEndpoints": [
{
"Name": "Source",
"EndpointEnrichers": null
},
{
"Name": "Target",
"EndpointEnrichers": null
}
]
}
}

[MrHinsh]

The (401) Unauthorized error is coming from the server. This is not something we can control.

Here are the reasons that you would get a 401 from a PAT:

1. PAT is not "full access" - full access is required by the Object Model.
2. PAT is invalid or has expired - if it's in the wild, it will be auto expired
3. PAT are disabled/restricted on your environment
4. Something is wrong with your account or the org.

If none of those things are true then you may need to raise a support request with Microsoft to resolve the issue with your account!

Things to try:

• Test a token from a different user
• Test a token with a different org.

[MrHinsh]

If so, can you recreate your tokens?

[MrHinsh]

Here are the reasons that you would get a 401 from a PAT:

1. PAT is not "full access"
2. PAT is invalid or has expired
3. PAT are disabled/restricted on your environemnt.

I'll add to this as I find more, but this is my current understanding.

[NotAwar]

Recreated fresh today, they are both "full access"

[NotAwar]

@MrHinsh any update here?

[MrHinsh]

There is not anything I can do on this end .Id recommend creating a support call with MSFT and see what's up.