In Azure DevOps/TFS web ui, click on your user picture in top right -> Security -> Personal access tokens -> New Token.

• In the organization dropdown, select "All accessible organizations"
• Either provide a "full access" scope, or more granular access that should include:
  • Build - Read and execute
  • Code - Read, Status (for getting pull requests)
  • Graph - Read
  • Identity - Read
  • Project and Team - Read
  • Release - Read
  • Test management - Read
  • User Profile - Read
  • Work Items - Read and Write
• You can set a long expiration time to avoid repeating this process frequently (e.g. 1 year)

In the CatLight app, use a personal access token instead of a password, and keep the user name empty.