Skip to content

Update "Create a service connection for app registration authentication in Azure DevOps" #14393

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ronald Bosma (ronaldbosma) wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Update "Create a service connection for app registration authentication in Azure DevOps" #14393

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
579535a
Split "Create a service connection for app registration authenticatio…
ronaldbosma Aug 7, 2026
dafaddf
Refer to app registration for 'Directory (tenant) ID' param
ronaldbosma Aug 7, 2026
a048acd
Remove the repetitive "following parameters" from the configure workf…
ronaldbosma Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 24 additions & 21 deletions docs/pipelines/release/configure-workload-identity.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,20 +134,27 @@ You can also use the REST API for this process.

:::image type="content" source="media/workload-identity-manual-app-workload.png" alt-text="Screenshot that shows selecting the Workload Identity service connection for managed identity.":::

1. For **Service connection name**, enter a value such as `uamanagedidentity`. You'll use this value in your federated credential subject identifier.
1. In **Step 1: Basics**:

**Step 1: Basics**, enter or select the following parameters:

| Parameter | Description |
| --------- | ----------- |
| **Service Connection Name** | Required. You'll use this value in your federated credential subject identifier. |
| **Description** | Optional. The description of the service connection. |
| **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. |
| **Directory (tenant) ID** | Required. Enter the Tenant ID from your managed identity. |

1. Select **Next**.

1. In **Step 2: App registration details**:

**Step 2: App registration details** contains the following parameters. Enter or select the following parameters:
**Step 2: App registration details**, enter or select the following parameters:

| Parameter | Description |
| --------- | ----------- |
| **Issuer** | Required. DevOps automatically creates the issuer URL. |
| **Subject identifier** | Required. DevOps automatically creates the subject identifier. |
| **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. |


1. Select the **Scope Level**. Select **Subscription**, **Management Group**, or **Machine Learning Workspace**. [Management groups](/azure/azure-resource-manager/management-groups-overview) are containers that help you manage access, policy, and compliance across multiple subscriptions. A [Machine Learning Workspace](/azure/machine-learning/concept-workspace) is place to create machine learning artifacts.

Expand Down Expand Up @@ -175,13 +182,7 @@ You can also use the REST API for this process.
| **ML Workspace Name** | Required. Enter the name of the existing Azure Machine Learning workspace. |
| **ML Workspace Location** | Required. Enter the location of the existing Azure Machine Learning workspace. |

1. In the **Authentication** section, enter or select the following parameters:

| Parameter | Description |
| --------- | ----------- |
| **Application (client) ID** | Required. Enter the Client ID for your managed identity. |
| **Directory (tenant) ID** | Required. Enter the Tenant ID from your managed identity. |

1. In the **Authentication** section, for **Application (client) ID**, enter the Client ID for your managed identity.

1. In the **Security** section, if you select **Grant access permission to all pipelines**, all pipelines can use this connection. Don't use this option. Instead, [authorize each pipeline individually to use the service connection](../library/service-endpoints.md#authorize-pipelines).

Expand Down Expand Up @@ -272,19 +273,27 @@ You can also use the REST API for this process.

:::image type="content" source="media/workload-identity-manual-app-workload.png" alt-text="Screenshot that shows selecting the Workload Identity service connection.":::

1. For **Service connection name**, enter a value such as `uaappregistration`. You'll use this value in your federated credential subject identifier.
1. In **Step 1: Basics**:

**Step 1: Basics**, enter or select the following parameters:

| Parameter | Description |
| --------- | ----------- |
| **Service Connection Name** | Required. You'll use this value in your federated credential subject identifier. |
| **Description** | Optional. The description of the service connection. |
| **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. |
| **Directory (tenant) ID** | Required. Enter the Tenant ID from your app registration. |

1. Select **Next**.

1. In **Step 2: App registration details**:

**Step 2: App registration details** contains the following parameters. Enter or select the following parameters:
**Step 2: App registration details**, enter or select the following parameters:

| Parameter | Description |
| --------- | ----------- |
| **Issuer** | Required. DevOps automatically creates the issuer URL. |
| **Subject identifier** | Required. DevOps automatically creates the subject identifier. |
| **Environment** | Required. Choose a cloud environment to connect to. If you select **Azure Stack**, enter the environment URL, which is something like `https://management.local.azurestack.external`. |


1. Select the **Scope Level**. Select **Subscription**, **Management Group**, or **Machine Learning Workspace**. [Management groups](/azure/azure-resource-manager/management-groups-overview) are containers that help you manage access, policy, and compliance across multiple subscriptions. A [Machine Learning Workspace](/azure/machine-learning/concept-workspace) is place to create machine learning artifacts.
Expand Down Expand Up @@ -313,13 +322,7 @@ You can also use the REST API for this process.
| **ML Workspace Name** | Required. Enter the name of the existing Azure Machine Learning workspace. |
| **ML Workspace Location** | Required. Enter the location of the existing Azure Machine Learning workspace. |

1. In the **Authentication** section, enter or select the following parameters:

| Parameter | Description |
| --------- | ----------- |
| **Application (client) ID** | Required. Enter the Application (client) ID for your app registration. |
| **Directory (tenant) ID** | Required. Enter the Directory (tenant) ID for your app registration. |

1. In the **Authentication** section, for **Application (client) ID**, enter the Client ID for your app registration.

1. In the **Security** section, if you select **Grant access permission to all pipelines**, all pipelines can use this connection. Don't use this option. Instead, [authorize each pipeline individually to use the service connection](../library/service-endpoints.md#authorize-pipelines).

Expand Down