Azure DevOps service connections and PATs — quick notes
Service connections and PATs — quick notes
| Item | Detail |
|---|---|
| Recommended new ARM authentication | Workload identity federation with an app registration or managed identity — no secret management |
| Affected issuer deprecation | Eligible public-cloud, single-tenant-app or managed-identity WIF connections retire July 1, 2027; non-public clouds and multitenant apps are excluded |
| Conversion guidance | Convert an affected existing connection to the Microsoft Entra issuer; don't recreate it |
| Authorisation | Authorise each pipeline individually; all existing and future pipelines is supported but not recommended |
| Service connection is | A protected resource — can carry checks |
| PAT | A user credential — minimal scope, short expiry |
| Offboarding | Revoke PATs; disabling the user also revokes them after up to one hour of processing |
Sources: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400 · https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/release/convert-service-connections?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/process/about-resources?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/authentication-guidance?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/admin-revoke-user-pats?view=azure-devops