## TL;DR
The service connection's stored credential expired or was revoked: the remote returns 401 on every use. Edit the service connection, re-enter or re-authorize the credential, and verify the connection. Pipelines authenticate again once the stored secret is fresh.

## Error
```text
azure devops: The remote server returned an error: (401) Unauthorized on service connection
```

## Steps
1. Open the service connection in project settings and run "Verify". Expected: it fails with 401, confirming the stored credential is the problem.
2. Check what credential it uses: PAT, service principal secret, or OAuth. Expected: you know which secret expired.
3. Refresh it: generate a new PAT or secret at the remote end, then edit the service connection and save the new value (or complete the OAuth re-authorization). Expected: the connection stores the fresh credential.
4. Verify again from the settings page. Expected: the verification succeeds.
5. Re-run the pipeline. Expected: the tasks using the connection authenticate.

## When to use
- Pipelines fail with 401 on a service connection that used to work
- After PAT or secret expiry at the remote end
- New service connections that never verified

## When not to use
- Pipeline-level permission errors (not connection auth)
- 403s (authorized but forbidden: scope issue)

## Tool compatibility
- Azure DevOps service connections; PATs, service principals, OAuth

## Variant phrasings
### service connection 401 azure devops
The stored credential expired; re-authorize and verify.

### verify service connection fails
Generate a fresh credential at the remote and save it into the connection.

## Why it happens
Service connections cache a credential at creation time and never refresh it automatically. PATs and secrets expire on their own schedule, so a working pipeline breaks the day the stored credential dies, with no warning until the next run.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TtpfFDwCs-bD1Gzs9q38BA