TF909091: Guest users are not permitted to access this organization as per organization policy

[johnnyreilly]

Updated 27/12/2025

This was originally opened for an issue with specifying the registry. I've a workaround for that issue, but the subsequent issue discovered here is still an issue #50 (comment) - please skip what is directly below to read that instead

Original issue - there's a workaround

Describe the bug

When trying to use this project with private feeds I receive this error:

Unable to authenticate, your authentication token seems to be invalid.

To Reproduce
Steps to reproduce the behavior:

1. Run npx --yes ado-npm-auth in a folder with an .npmrc that looks something like this:

registry=https://pkgs.dev.azure.com/johnnyreilly/_packaging/npmrc-script-organization/npm/registry/ 
                        
always-auth=true

2. See something like this:

npm error code E401
npm error Unable to authenticate, your authentication token seems to be invalid.
npm error To correct this please try logging in again with:
npm error   npm login

Logs look something like this:

0 verbose cli /usr/local/bin/node /usr/local/lib/node_modules/npm/bin/npm-cli.js
1 info using npm@10.8.2
2 info using node@v20.17.0
3 silly config load:file:/usr/local/lib/node_modules/npm/npmrc
4 silly config load:file:/Users/john.reilly/code/dev.azure.com/URLHERE/.npmrc
5 silly config load:file:/Users/john.reilly/.npmrc
6 silly config load:file:/usr/local/etc/npmrc
7 verbose title npm exec ado-npm-auth
8 verbose argv "exec" "--yes" "--" "ado-npm-auth"
9 verbose logfile logs-max:10 dir:/Users/john.reilly/.npm/_logs/2024-10-29T20_30_18_626Z-
10 verbose logfile /Users/john.reilly/.npm/_logs/2024-10-29T20_30_18_626Z-debug-0.log
11 silly logfile start cleaning logs, removing 1 files
12 silly logfile done cleaning log files
13 silly packumentCache heap:4345298944 maxSize:1086324736 maxEntrySize:543162368
14 http fetch GET 401 https://pkgs.dev.azure.com/ORG/_packaging/FEED/npm/registry/ado-npm-auth 284ms (cache skip)
15 verbose stack HttpErrorAuthUnknown: Unable to authenticate, need: Bearer authorization_uri=https://login.windows.net/***, Basic realm="https://pkgsprodsu3weu.app.pkgs.visualstudio.com/", TFS-Federated
15 verbose stack     at /usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/lib/check-response.js:80:17
15 verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
15 verbose stack     at async RegistryFetcher.packument (/usr/local/lib/node_modules/npm/node_modules/pacote/lib/registry.js:90:19)
15 verbose stack     at async RegistryFetcher.manifest (/usr/local/lib/node_modules/npm/node_modules/pacote/lib/registry.js:128:23)
15 verbose stack     at async getManifest (/usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:27:22)
15 verbose stack     at async missingFromTree (/usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:60:22)
15 verbose stack     at async /usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:182:32
15 verbose stack     at async Promise.all (index 0)
15 verbose stack     at async exec (/usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:180:3)
15 verbose stack     at async Npm.exec (/usr/local/lib/node_modules/npm/lib/npm.js:207:9)
16 verbose statusCode 401
17 verbose pkgid ado-npm-auth@*
18 error code E401
19 error Unable to authenticate, your authentication token seems to be invalid.
20 error To correct this please try logging in again with:
20 error   npm login

Expected behavior
I was expecting no error.

Screenshots
N/A

Desktop (please complete the following information):

• OS: Mac
• Browser N/A
• Version 0.3.0 - https://www.npmjs.com/package/ado-npm-auth/v/0.3.0

Other info

I'm authenticated with Azure DevOps already. Doing npm login doesn't seem to work.

[johnnyreilly]

I couldn't get past this and ended up spinning up my own project to resolve this. If you bump on the same issues as me then you might find it helpful too! You can find it here:

https://github.com/johnnyreilly/azdo-npm-auth

and there's an intro blog post here: https://johnnyreilly.com/introducing-azdo-npm-auth

[johnnyreilly]

As an aside, I was able to get past the initial issue by using npm_config_registry=https://registry.npmjs.org npx ado-npm-auth.

Alas I encountered other issues which I thought I'd share here:

npm_config_registry=https://registry.npmjs.org npx ado-npm-auth
Need to install the following packages:
ado-npm-auth@0.3.1
Ok to proceed? (y) y

🔑 Authenticating to package feed...
Encountered error while performing auth Error: Failed to get Ado Pat from npx AzureAuth: TF909091: Guest users are not permitted to access this organization as per organization policy. For more information, please contact your organization administrator.
An unexpected error ocurred. Re-run with --verbosity=debug for more info.

    at gC (/Users/john.reilly/.npm/_npx/db64d855fa186e0a/node_modules/ado-npm-auth/dist/ado-npm-auth.cjs:157:1982)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async yC (/Users/john.reilly/.npm/_npx/db64d855fa186e0a/node_modules/ado-npm-auth/dist/ado-npm-auth.cjs:157:2113)
    at async bx (/Users/john.reilly/.npm/_npx/db64d855fa186e0a/node_modules/ado-npm-auth/dist/ado-npm-auth.cjs:188:2472)
❌ Authentication to package feed failed.

At the time I was accessing my work organisation, from my work machine, and I was authenticated using my work credentials. But I still received messages about being a Guest users are not permitted.

Happily azdo-npm-auth does not experience this issue and I'm able to use that instead. Is there something specific that azdo is doing that we could contribute to ado?

It would be better to have one unified tool out there that handled all cases.

[acmoles]

+1 same error on Windows, adding the user env variable npm_config_registry=https://registry.npmjs.org as workaround

[vs4vijay]

Since you're in a directory where the .npmrc file points to a private registry, running npm exec will attempt to download from the private registry and fail due to the lack of authentication. This creates a chicken-and-egg problem. The best solution is to use the command npm exec --registry=https://registry.npmjs.org -y ado-npm-auth.