To register an build agent, PAT (personal access token) is required to connect an agent to Azure Pipelines. A PAT has an expiry attached to it which could be 90 days, 180 days or 1 year. So question is What happens when VSTS PAT (personal access token) used for Build Agent expires?
Will the Build agent still work? What will happen if I restart build agent after PAT expires?
Actually the build agent will still work. PAT is needed only at the time of build agent registration and is not persisted on the agent, and is not used in any subsequent communication between the agent and the Azure Pipelines. Actually once the registration is complete, the agent downloads the listener OAuth JWT token and uses it to listen the job queue. This JWT token is encrypted / stored securely and has limited rights. Once there is job available to execute on this listener, it uses another job-specific OAuth token to run it.
You can read more details from Build and Release Agents