My understanding is that this is a GCM limitation due to the way that git.exe handles expired PATs. Are there any plans to implement a fix or improvement for the issue, or recommendations for a workaround?

A bit more info:

Is there a workaround for needing to retry?
Yes, you can switch from using PATs to using OAuth by running the following command:

git config --global credential.azreposCredentialType oauth
I've validated that ^ switches to OAuth and eliminates the need to re-auth due to PATs expiring.

Why do PATs require re-trying the git.exe op? git will fail after the PAT has expired, but GCM doesn't have a way to know that it's expired without trying again. tldr; GCM implementation detail.

Will there be a fix that eliminates the need to retry to surface the GCM dialog? Git improvements to credential helper protocol would allow GCM to respond to an initial failure and get a second chance to retry/reauth.

Why does GCM default to PATs instead of OAuth?
PATs were the default before OAuth was supported by GCM. It also used to be the case that some very old versions of Git didn't support long tokens, but this is no longer the case.

What's the different between PATs and OAuth? Are the any drawbacks to switching to OAuth?

The main difference and complication with OAuth is that GCM would now maintain an identity -> resource mapping, whereas before the PAT was directly linked to the URL/resource. There are some edge cases or weird set ups with multiple user accounts or guests in a tenant that can confuse GCM, and haven’t been well tested.

cc @mjcheetham

I'm facing a similar issue, but am not using PATs.

My first call to git fetch fails with:

fatal: Authentication failed for 'https://<redacted>.visualstudio.com/1ES/_git/<redacted>/'

But the subsequent invocation of git fetch triggers a re-auth flow (auto opens the browser, has me pick an account, completes) then completes the fetch.

This is what I have in my .gitconfig:

[credential]
	helper = 
	helper = /usr/local/share/gcm-core/git-credential-manager
[credential "https://dev.azure.com"]
	useHttpPath = true

$ git --version
git version 2.39.0

$ /usr/local/share/gcm-core/git-credential-manager --version
2.5.0+d34930736e131ad80e5690e5634ced1808aff3e2

macOS 15.1.1 (24B91)