VSTS Personal Access Token (PAT) vs OAUTH: different results of query - powershell

Question

I am using a PowerShell task to among others query a TFVC repository for changes after a certain point of time. To develop locally I created a PAT related to my user. In the release definition I enabled Allow scripts to access OAUTH token. If I now execute the release definition with the PAT respectively the OAUTH I get different results for existing changes (e.g. count is 1 for PAT and 0 for OAUTH). The queries are exactly the same:
https://xxx.visualstudio.com/xxx/_apis/tfvc/changesets?searchCriteria.itemPath=$projectPath&searchCriteria.fromDate=$cloudVersionTimestampUTC&api-version=4.1
Here the code to execute the query:
Write-Host "Get Request with the URI '$uri'"
if ($localDevelopment) {
$GetResponse = Invoke-RestMethod `
-Uri $uri `
-Headers #{Authorization = 'Basic ' + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$($env:SYSTEM_ACCESSTOKEN)")) }
Write-Host "Requested last changes for local development: $($GetResponse | ConvertTo-Json -Depth 100)"
}
else {
$GetResponse = Invoke-RestMethod `
-Uri $uri `
-Headers #{Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN" }
Write-Host "Requested last changes: $($GetResponse | ConvertTo-Json -Depth 100)"
}
Does someone know why this is the case?
Thanks
Edits:
here the permissions of the Project Collection Build Service (xxx) account:
It is also important to mention that we don't use hosted agents but custom ones.

Answer 1

The problem is the different handling of timestamps when comparing PAT and OAUTH. As you can see I use the variable $cloudVersionTimestampUTC for fromDate. When I set the timestamp I did not add Z (like MM-dd-yyyy HH:mm:ss instead of MM-dd-yyyy HH:mm:ssZ). PAT uses the given timestamp as UTC, OAUTH interprets it as local time (but I am not sure of what - e.g. the default profile) when Z is not provided. This of course led to a different number of changesets (if the missing changeset was in the difference between UTC and local time).
In the end I had to be explicit about the timestamps. So what I did was to get the timestamp as string that was stored as tag in the Azure Resource and do the following:
$cloudVersionTimestampUTC = [DateTime]($cloudJobDefinition.Tags.'version-timestamp')
$cloudVersionTimestampUTC = (Get-Date -Date $cloudVersionTimestampUTC).ToString("MM-dd-yyyy HH:mm:ssZ")
Then I was able to make the REST Call and retrieve the same number of changesets.