When connecting to a cloud org (Azure DevOps Services), the user should be able to specify an argument (e.g. -UseAzCli or -azlogin) to tell TfsCmdlets that it should create an access token via the currently logged in Azure CLI user. That way, user does not need to generate PATs when running TfsCmdlets scripts in the context of an Azure connection (e.g. inside of an AzCLI pipeline task, or at the command line).

Bonus points if it also supports managed identities (-UseMsi) and service principal (-UseServicePrincipal) identities.