From 579535afaa2c3546fb2078c446f341ab25d2de3c Mon Sep 17 00:00:00 2001 From: Ronald Bosma Date: Fri, 7 Aug 2026 10:07:22 +0200 Subject: [PATCH 1/3] Split "Create a service connection for app registration authentication in Azure DevOps" into two steps --- .../release/configure-workload-identity.md | 41 ++++++++++--------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/docs/pipelines/release/configure-workload-identity.md b/docs/pipelines/release/configure-workload-identity.md index 4b02161bdf3..86407dfab26 100644 --- a/docs/pipelines/release/configure-workload-identity.md +++ b/docs/pipelines/release/configure-workload-identity.md @@ -134,7 +134,16 @@ You can also use the REST API for this process. :::image type="content" source="media/workload-identity-manual-app-workload.png" alt-text="Screenshot that shows selecting the Workload Identity service connection for managed identity."::: -1. For **Service connection name**, enter a value such as `uamanagedidentity`. You'll use this value in your federated credential subject identifier. +1. In **Step 1: Basics**: + + **Step 1: Basics** contains the following parameters. Enter or select the following parameters: + + | Parameter | Description | + | --------- | ----------- | + | **Service Connection Name** | Required. You'll use this value in your federated credential subject identifier. | + | **Description** | Optional. The description of the service connection. | + | **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. | + | **Directory (tenant) ID** | Required. Enter the Tenant ID from your managed identity. | 1. Select **Next**. @@ -146,8 +155,6 @@ You can also use the REST API for this process. | --------- | ----------- | | **Issuer** | Required. DevOps automatically creates the issuer URL. | | **Subject identifier** | Required. DevOps automatically creates the subject identifier. | - | **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. | - 1. Select the **Scope Level**. Select **Subscription**, **Management Group**, or **Machine Learning Workspace**. [Management groups](/azure/azure-resource-manager/management-groups-overview) are containers that help you manage access, policy, and compliance across multiple subscriptions. A [Machine Learning Workspace](/azure/machine-learning/concept-workspace) is place to create machine learning artifacts. @@ -175,13 +182,7 @@ You can also use the REST API for this process. | **ML Workspace Name** | Required. Enter the name of the existing Azure Machine Learning workspace. | | **ML Workspace Location** | Required. Enter the location of the existing Azure Machine Learning workspace. | - 1. In the **Authentication** section, enter or select the following parameters: - - | Parameter | Description | - | --------- | ----------- | - | **Application (client) ID** | Required. Enter the Client ID for your managed identity. | - | **Directory (tenant) ID** | Required. Enter the Tenant ID from your managed identity. | - + 1. In the **Authentication** section, for **Application (client) ID**, enter the Client ID for your managed identity. 1. In the **Security** section, if you select **Grant access permission to all pipelines**, all pipelines can use this connection. Don't use this option. Instead, [authorize each pipeline individually to use the service connection](../library/service-endpoints.md#authorize-pipelines). @@ -272,7 +273,16 @@ You can also use the REST API for this process. :::image type="content" source="media/workload-identity-manual-app-workload.png" alt-text="Screenshot that shows selecting the Workload Identity service connection."::: -1. For **Service connection name**, enter a value such as `uaappregistration`. You'll use this value in your federated credential subject identifier. +1. In **Step 1: Basics**: + + **Step 1: Basics** contains the following parameters. Enter or select the following parameters: + + | Parameter | Description | + | --------- | ----------- | + | **Service Connection Name** | Required. You'll use this value in your federated credential subject identifier. | + | **Description** | Optional. The description of the service connection. | + | **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. | + | **Directory (tenant) ID** | Required. Enter the Tenant ID from your managed identity. | 1. Select **Next**. @@ -284,7 +294,6 @@ You can also use the REST API for this process. | --------- | ----------- | | **Issuer** | Required. DevOps automatically creates the issuer URL. | | **Subject identifier** | Required. DevOps automatically creates the subject identifier. | - | **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. | 1. Select the **Scope Level**. Select **Subscription**, **Management Group**, or **Machine Learning Workspace**. [Management groups](/azure/azure-resource-manager/management-groups-overview) are containers that help you manage access, policy, and compliance across multiple subscriptions. A [Machine Learning Workspace](/azure/machine-learning/concept-workspace) is place to create machine learning artifacts. @@ -313,13 +322,7 @@ You can also use the REST API for this process. | **ML Workspace Name** | Required. Enter the name of the existing Azure Machine Learning workspace. | | **ML Workspace Location** | Required. Enter the location of the existing Azure Machine Learning workspace. | - 1. In the **Authentication** section, enter or select the following parameters: - - | Parameter | Description | - | --------- | ----------- | - | **Application (client) ID** | Required. Enter the Application (client) ID for your app registration. | - | **Directory (tenant) ID** | Required. Enter the Directory (tenant) ID for your app registration. | - + 1. In the **Authentication** section, for **Application (client) ID**, enter the Client ID for your app registration. 1. In the **Security** section, if you select **Grant access permission to all pipelines**, all pipelines can use this connection. Don't use this option. Instead, [authorize each pipeline individually to use the service connection](../library/service-endpoints.md#authorize-pipelines). From dafaddf32d20d6700dd86b673650619a619079ad Mon Sep 17 00:00:00 2001 From: Ronald Bosma Date: Fri, 7 Aug 2026 10:16:18 +0200 Subject: [PATCH 2/3] Refer to app registration for 'Directory (tenant) ID' param --- docs/pipelines/release/configure-workload-identity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pipelines/release/configure-workload-identity.md b/docs/pipelines/release/configure-workload-identity.md index 86407dfab26..b4e0f684151 100644 --- a/docs/pipelines/release/configure-workload-identity.md +++ b/docs/pipelines/release/configure-workload-identity.md @@ -282,7 +282,7 @@ You can also use the REST API for this process. | **Service Connection Name** | Required. You'll use this value in your federated credential subject identifier. | | **Description** | Optional. The description of the service connection. | | **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. | - | **Directory (tenant) ID** | Required. Enter the Tenant ID from your managed identity. | + | **Directory (tenant) ID** | Required. Enter the Tenant ID from your app registration. | 1. Select **Next**. From a048acde09fe6823ab88d98e13747b308d6dfd81 Mon Sep 17 00:00:00 2001 From: Ronald Bosma Date: Fri, 7 Aug 2026 15:09:15 +0200 Subject: [PATCH 3/3] Remove the repetitive "following parameters" from the configure workflow id page --- docs/pipelines/release/configure-workload-identity.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/pipelines/release/configure-workload-identity.md b/docs/pipelines/release/configure-workload-identity.md index b4e0f684151..c8bba3a5ed7 100644 --- a/docs/pipelines/release/configure-workload-identity.md +++ b/docs/pipelines/release/configure-workload-identity.md @@ -136,7 +136,7 @@ You can also use the REST API for this process. 1. In **Step 1: Basics**: - **Step 1: Basics** contains the following parameters. Enter or select the following parameters: + **Step 1: Basics**, enter or select the following parameters: | Parameter | Description | | --------- | ----------- | @@ -149,7 +149,7 @@ You can also use the REST API for this process. 1. In **Step 2: App registration details**: - **Step 2: App registration details** contains the following parameters. Enter or select the following parameters: + **Step 2: App registration details**, enter or select the following parameters: | Parameter | Description | | --------- | ----------- | @@ -275,7 +275,7 @@ You can also use the REST API for this process. 1. In **Step 1: Basics**: - **Step 1: Basics** contains the following parameters. Enter or select the following parameters: + **Step 1: Basics**, enter or select the following parameters: | Parameter | Description | | --------- | ----------- | @@ -288,7 +288,7 @@ You can also use the REST API for this process. 1. In **Step 2: App registration details**: - **Step 2: App registration details** contains the following parameters. Enter or select the following parameters: + **Step 2: App registration details**, enter or select the following parameters: | Parameter | Description | | --------- | ----------- |