Question

Your team uses an Azure Resource Manager service connection in Azure DevOps that authenticates with a service principal secret. Security policy now requires eliminating stored secrets that require manual rotation, while keeping existing pipeline YAML changes to a minimum. The subscription and target resources are in the same Azure AD tenant as your Azure DevOps organization. What should you do?

Accepted Answer

Convert the service connection to use workload identity federation so Azure DevOps exchanges a short-lived OIDC token for Azure access without a stored secret.

Answer

Rotate the service principal client secret automatically by storing it in Azure Key Vault and referencing it in a variable group.

Answer

Replace the service principal with a user-assigned managed identity assigned directly to the Microsoft-hosted agent pool.

Answer

Switch the service connection to use a personal access token (PAT) scoped to the deployment resource group.