Access token works for area paths and iterations but fails for work items (TF30063 Unauthorized)

[ma-chni]

@MrHinsh I'm using the TfsWorkItemMigrationProcessor (version 16.0.9) to migrate work items between two projects. The tool is configured with separate access tokens for the source and target projects.

When the migration starts, it successfully connects to both the source and target. It’s able to retrieve area paths and iterations from both sides without any issues. However, when it tries to fetch work items from the source project, I get the following error:

Initializing expensive WorkItemStore...
Error logged to Elmah.io! 
!! Check for latest version - We fix issues constantly - If not, please create a discussion on https://github.com/nkdAgility/azure-devops-migration-tools/discussions so we can get this fixed !!
[18:28:10 FTL] [16.0.9] Unable to configure store 
Microsoft.TeamFoundation.TeamFoundationServerUnauthorizedException: TF30063: You are not authorized to access <URL>.

Questions:

1. What might cause the token to be authorized for some operations (like retrieving areas and iterations) but unauthorized for reading work items?

2. Are different permissions or access levels required for accessing work items specifically?

3. Is there a way to debug or log the underlying permissions or failed calls to better diagnose this?

Any help would be appreciated. Thanks!

[MrHinsh]

Are you a collection admin on both the source and the target?

if not, it will not authenticate for WorkItemStore. See https://devopsmigration.io/docs/setup/permissions/