Narrowing permissions could be difference between mildly pwned and totally pwned corporate network - Microsoft is bringing a granular personal access token (PAT) to its Azure DevOps REST APIs to try to reduce the damage that can happen when credentials are leaked or stolen.