Question

Your organization has 40 Azure DevOps projects. The platform team creates an ARM service connection in a shared 'Infrastructure' project that authenticates to a production subscription. Several other project teams request access to deploy through this same connection. Security requires that only explicitly approved pipelines can use the connection, and that access can be revoked per project without deleting the connection. What should you configure?

Accepted Answer

Share the service connection to each requesting project individually, and in each project set the connection's pipeline permissions so only named pipelines are authorized (disable 'Grant access permission to all pipelines').

Answer

Recreate the service connection as organization-scoped and add every requesting pipeline to a global allow list.

Answer

Give each requesting team the Endpoint Administrator role on the Infrastructure project so they can manage the connection themselves.

Answer

Export the service principal credentials and have each team create their own identical service connection in their project.