You can try to create a new PAT with full access and then run the `config.cmd` again.
[![enter image description here][1]][1]
In addition, please check if you are running a firewall or a proxy on the bastion host. If you're running an agent in a secure network behind a firewall, make sure the agent can initiate communication with the URLs and IP addresses mentioned in below documents.
- [What URLs does the agent need to communicate with?][2] - [How do I configure the agent to bypass a web proxy and connect to Azure Pipelines?][3]
[1]: https://i.stack.imgur.com/XJNVF.png [2]: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-linux?view=azure-devops#im-running-a-firewall-and-my-code-is-in-azure-repos-what-urls-does-the-agent-need-to-communicate-with [3]: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-linux?view=azure-devops#how-do-i-configure-the-agent-to-bypass-a-web-proxy-and-connect-to-azure-pipelines

Firstly, please make sure you can access the Azure DevOps organization (`https://dev.azure.com/{organization}`) from the bastion host. Otherwise we cannot connect to the Azure DevOps services.
Secondly, please check if you are running a firewall or a proxy on the bastion host. If you're running an agent in a secure network behind a firewall, make sure the agent can initiate communication with the URLs and IP addresses mentioned in below documents.
- [What URLs does the agent need to communicate with?][1] - [How do I configure the agent to bypass a web proxy and connect to Azure Pipelines?][2]
[1]: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-linux?view=azure-devops#im-running-a-firewall-and-my-code-is-in-azure-repos-what-urls-does-the-agent-need-to-communicate-with [2]: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-linux?view=azure-devops#how-do-i-configure-the-agent-to-bypass-a-web-proxy-and-connect-to-azure-pipelines