{"id":4754,"date":"2026-08-06T08:57:40","date_gmt":"2026-08-06T08:57:40","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/06\/you-can-now-use-the-azure-devops-service-connection-instead-of-a-pat-or-build-session-token\/"},"modified":"2026-08-06T08:57:40","modified_gmt":"2026-08-06T08:57:40","slug":"you-can-now-use-the-azure-devops-service-connection-instead-of-a-pat-or-build-session-token","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/06\/you-can-now-use-the-azure-devops-service-connection-instead-of-a-pat-or-build-session-token\/","title":{"rendered":"You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token"},"content":{"rendered":"<p>We\u2019re excited to announce the <strong>Azure DevOps service connection<\/strong>, a new way to access Azure DevOps from your pipelines using a Microsoft Entra workload identity (a service principal or managed identity) instead of a Personal Access Token (PAT) or session token. This post walks through what it is, how to set it up, and the many places you can use it, including several capabilities we\u2019ve added based on your feedback.<\/p>\n<h2>Why use an Azure DevOps service connection?<\/h2>\n<p>Using an Azure DevOps service connection improves the security of your pipelines in several ways:<\/p>\n<ul>\n<li><strong>PAT-free authentication:<\/strong> Eliminate the need to create, store, and rotate <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/organizations\/accounts\/use-personal-access-tokens-to-authenticate\">Personal Access Tokens<\/a><\/li>\n<li><strong>Least privilege:<\/strong> Use per-pipeline or even task-level permissions instead of shared <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/pipelines\/process\/access-tokens\">build service account permissions<\/a><\/li>\n<li><strong>No persistent secrets:<\/strong> Use Microsoft Entra federated credentials instead of passwords<\/li>\n<li><strong>Audit trail:<\/strong> All authentication attempts are logged in the Azure DevOps audit log<\/li>\n<\/ul>\n<p>Because the connection authenticates as a Microsoft Entra identity, you can also use it to reach resources in <strong>another Azure DevOps organization<\/strong> that\u2019s joined to the same Entra ID tenant.<\/p>\n<h2>Configuring an Azure DevOps service connection<\/h2>\n<blockquote>\n<p><strong>Important pre-requisite<\/strong> The service connection creation experience does not create an identity in Entra or user in Azure DevOps. Both are a pre-requisite to creating the new Azure DevOps service connection. Before you create a service connection, first add a <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/integrate\/get-started\/authentication\/service-principal-managed-identity\">service principal or managed identity<\/a> as a user in the organization and assign it the permissions it needs.<\/p>\n<\/blockquote>\n<p>After you added a <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/integrate\/get-started\/authentication\/service-principal-managed-identity\">service principal or managed identity<\/a> as a user in the organization and assigned it the permissions, you can create a the new service connection and choose <strong>Azure DevOps (preview)<\/strong>:<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2026\/07\/new-azdo-sc1.webp\"><img data-opt-id=1389747433  fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2026\/07\/new-azdo-sc1.webp\" alt=\"new azdo sc1 image\" width=\"326\" height=\"74\" class=\"aligncenter size-full wp-image-73151\" \/><\/a><\/p>\n<p>Select the service principal or managed identity you created as the identity to use:<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2026\/07\/new-azdo-sc2.webp\"><img data-opt-id=20305219  fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2026\/07\/new-azdo-sc2.webp\" alt=\"new azdo sc2 image\" width=\"930\" height=\"1108\" class=\"aligncenter size-full wp-image-73152\" \/><\/a><\/p>\n<p>You should assign the identity the permissions to the organization it needs. You can do this by following the <strong>View access in the current organization<\/strong> link and e.g. adding it to the Readers group of the current project.<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2026\/07\/new-azdo-sc3.webp\"><img data-opt-id=1957367172  data-opt-src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2026\/07\/new-azdo-sc3.webp\"  decoding=\"async\" src=\"data:image/svg+xml,%3Csvg%20viewBox%3D%220%200%20100%%20100%%22%20width%3D%22100%%22%20height%3D%22100%%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Crect%20width%3D%22100%%22%20height%3D%22100%%22%20fill%3D%22transparent%22%2F%3E%3C%2Fsvg%3E\" alt=\"new azdo sc3 image\" width=\"424\" height=\"259\" class=\"aligncenter size-full wp-image-73153\" \/><\/a><\/p>\n<h3>Manual configuration as fallback<\/h3>\n<p>In some cases the signed-in user can\u2019t create the federated identity credential (FIC) automatically. For example, when the user lacks Microsoft Graph permissions and sees. For these scenarios the experience will fall back and instruct you how to create the federated credential <strong>manually<\/strong>. The configuration UI surfaces the issuer and subject so an administrator with the right permissions can add the federated credential to the identity, then complete the connection.<\/p>\n<h2>Using the Azure DevOps service connection<\/h2>\n<p>Check out a repository from another organization<\/p>\n<pre><code class=\"yaml\">resources:\n  repositories:\n  - repository: external-repo\n    type: git\n    endpoint: my-azdo-connection\n    name: 'external-project\/external-repo'\n    ref: 'refs\/heads\/main'\n\nsteps:\n- checkout: self\n- checkout: external-repo\n<\/code><\/pre>\n<p>Reference a YAML template from another organization<\/p>\n<pre><code class=\"yaml\">resources:\n  repositories:\n    - repository: templates\n      type: git\n      endpoint: my-azdo-connection\n      name: 'external-project\/external-repo'\n      ref: \"refs\/heads\/main\"\n\nsteps:\n- template: azdosc-template.yml@templates\n<\/code><\/pre>\n<p>You can now use runtime parameters to select the service connection used by a repository resource. This makes templates reusable across organizations and environments, the caller supplies the connection name.<\/p>\n<pre><code class=\"yaml\">parameters:\n- name: serviceConnectionName\n  type: string\n  default: my-azdo-connection\n\nresources:\n  repositories:\n  - repository: templates\n    type: git\n    endpoint: ${{ parameters.serviceConnectionName }}\n    name: 'external-project\/external-repo'\n    ref: \"refs\/heads\/main\"\n<\/code><\/pre>\n<h3>Access an artifacts feed<\/h3>\n<pre><code class=\"yaml\">- task: NuGetAuthenticate@1\n  inputs:\n    nuGetServiceConnections: 'my-azdo-connection'\n\n- task: DotNetCoreCLI@2\n  inputs:\n    command: 'restore'\n    projects: '**\/*.csproj'\n<\/code><\/pre>\n<h3>Call Azure DevOps REST APIs from the Invoke REST API task<\/h3>\n<p>The <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/pipelines\/tasks\/reference\/invoke-rest-api-v1\">Invoke REST API task<\/a> (<code>InvokeRESTAPI@1<\/code>) now accepts an Azure DevOps service connection, so you can call Azure DevOps REST APIs without a custom generic connection and manual token handling. Set <code>connectionType<\/code> to <code>connectedServiceNameAzureDevOps<\/code>:<\/p>\n<pre><code class=\"yaml\">- task: InvokeRESTAPI@1\n  inputs:\n    connectionType: 'connectedServiceNameAzureDevOps'\n    serviceConnection: 'my-azdo-connection'\n    method: 'GET'\n    urlSuffix: 'external-project\/_apis\/build\/builds?api-version=7.1'\n<\/code><\/pre>\n<h2>Using the connection in a script<\/h2>\n<p>The new <code>AzureCLI@3<\/code> task can access Azure DevOps with Microsoft Entra authentication in several ways. In all cases, set <code>connectionType: 'azureDevOps'<\/code> and assign <code>azureDevOpsServiceConnection<\/code> to your Azure DevOps service connection:<\/p>\n<pre><code class=\"yaml\">- task: AzureCLI@3\n  inputs:\n    connectionType: 'azureDevOps'\n    azureDevOpsServiceConnection: 'my-azdo-connection'\n<\/code><\/pre>\n<p>This creates a Microsoft Entra authenticated session with the <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/cli\">Azure DevOps CLI<\/a>:<\/p>\n<pre><code class=\"yaml\">- task: AzureCLI@3\n  displayName: Secret-less\n  inputs:\n    connectionType: 'azureDevOps'\n    azureDevOpsServiceConnection: 'my-azdo-connection'\n    scriptType: 'pscore'\n    scriptLocation: 'inlineScript'\n    inlineScript: |\n      az devops configure -l\n\n      az devops project list --query \"value[].{Name:name, Id:id}\" `\n                            -o table\n\n      az pipelines pool list --query \"[].{Id:id, Name:name}\" `\n                            -o table\n\n      az rest --method get `\n              --url \"https:\/\/status.dev.azure.com\/_apis\/status\/health?api-version=7.1-preview.1\" `\n              --resource 499b84ac-1321-427f-aa17-267ca6975798 `\n              --query \"sort_by(services[?id=='Pipelines'].geographies | [], &amp;name)\" `\n              -o table\n<\/code><\/pre>\n<p>If you have an existing script that uses a PAT or <code>System.AccessToken<\/code> inline, you can instead obtain a Microsoft Entra access token to access Azure DevOps:<\/p>\n<pre><code class=\"yaml\">- task: AzureCLI@3\n  displayName: Use Entra access token\n  inputs:\n    connectionType: 'azureDevOps'\n    azureDevOpsServiceConnection: 'my-azdo-connection'\n    scriptType: 'pscore'\n    scriptLocation: 'inlineScript'\n    inlineScript: |\n      # Get access token for Azure DevOps\n      $token = az account get-access-token --resource \"499b84ac-1321-427f-aa17-267ca6975798\" `\n                                           --query \"accessToken\" `\n                                           --output tsv\n\n      # Use token in REST API call\n      $headers = @{\n        Authorization = \"Bearer $token\"\n        \"Content-Type\" = \"application\/json\"\n      }\n\n      $body = @{\n        name = \"Test Build\"\n      } | ConvertTo-Json\n\n      Invoke-RestMethod -Uri \"$(System.CollectionUri)$(System.TeamProject)\/_apis\/build\/definitions?api-version=7.1\" `\n                        -Method POST `\n                        -Headers $headers `\n                        -Body $body\n<\/code><\/pre>\n<h2>More information<\/h2>\n<p>For more information on configuring the Azure DevOps service connection, see the <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/pipelines\/library\/add-devops-entra-service-connection?view=azure-devops\">documentation<\/a>. We\u2019d love your feedback on the <a href=\"https:\/\/developercommunity.visualstudio.com\/\">Azure DevOps Developer Community<\/a> or through <a href=\"https:\/\/aka.ms\/AzureDevOpsSupport\">Azure DevOps Support<\/a>.<\/p>\n<p>The post <a href=\"https:\/\/devblogs.microsoft.com\/devops\/you-can-now-use-the-azure-devops-service-connection-instead-of-a-pat-or-build-session-token\/\">You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token<\/a> appeared first on <a href=\"https:\/\/devblogs.microsoft.com\/devops\">Azure DevOps Blog<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>We\u2019re excited to announce the Azure DevOps service connection, a new way to access Azure DevOps from your pipelines using [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4755,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[3],"tags":[],"class_list":["post-4754","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4754","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4754"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4754\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4755"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4754"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4754"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4754"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}