Question

Your team runs a set of Azure DevOps self-hosted agents on an Azure Virtual Machine Scale Set. Pipelines running on these agents must authenticate to Azure Key Vault and an Azure Storage account. Currently, a service principal's client secret is stored in a pipeline variable group and passed to the agents at runtime. Security has flagged that the secret is nearing expiry and requires manual rotation, and they want to eliminate stored credentials entirely for these Azure resource calls made directly from the agent VMs. What should you implement?

Accepted Answer

Assign a system-assigned managed identity to the VM Scale Set and grant it RBAC access to Key Vault and Storage

Answer

Create a new service principal with a certificate credential and store the certificate in a secure file in the pipeline library

Answer

Rotate the service principal's client secret automatically using a scheduled pipeline that updates the variable group

Answer

Convert the service principal to a multi-tenant app registration and use a longer-lived client secret