TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Azure DevOps Service Connection with Microsoft Entra

20 posts · Oct 2015 – Aug 2026

What this trail covers

Azure DevOps continues to enhance its authentication and authorization capabilities by introducing the Azure DevOps service connection. This new method allows pipelines to access Azure DevOps resources using Microsoft Entra workload identities (service principals or managed identities) instead of Personal Access Tokens (PATs) or session tokens. This improves security by eliminating the need for persistent secrets, enabling least privilege access, and providing a clear audit trail. This post announces the full web support for conditional access policies across Azure DevOps and partner web properties, utilizing Microsoft Entra tokens for web sessions. This allows for hourly evaluation of identity compliance with Entra policies, supporting a wider range of conditional access policies like device compliance, which was previously limited to less frequent IP-fencing evaluations. Non-interactive flows will continue to support IP-fencing.

All Microsoft trails
  1. You can now use the Azure DevOps Service Connection instead of a PAT or Build Session tokenThis post introduces the Azure DevOps service connection, a new authentication mechanism for pipelines that leverages Microsoft Entra workload identities (service principals or managed identities) instead of PATs or session tokens. It details the benefits of this approach, including enhanced security through PAT-free authentication, least privilege, no persistent secrets, and an audit trail. The post provides step-by-step instructions for configuring the service connection, including prerequisites and manual configuration fallbacks. It also demonstrates various use cases, such as accessing repositories and YAML templates from other organizations, interacting with artifact feeds, calling Azure DevOps REST APIs via the Invoke REST API task, and using the Azure CLI with the new connection type for secret-less operations and Entra token acquisition.
  2. Retirement of Azure DevOps issuer in Workload identity federation service connectionsAnnounces the deprecation of the Azure DevOps issuer (`https://vstoken.dev.azure.com`) in workload identity federation (WIF) service connections, with a retirement date of July 1, 2027. New service connections created since November 2025 already use the Microsoft Entra issuer (`https://login.microsoftonline.com/`). Existing service connections using the Azure DevOps issuer will show warnings starting July 2026 and will be retired on July 1, 2027. Provides instructions for converting existing service connections to use the Microsoft Entra issuer.
  3. Optimizing Git policy management at scaleIntroduced a new `refName=~all` parameter to the `GET /_apis/git/policy/configurations` REST API endpoint in Azure DevOps. This enhancement allows for the efficient retrieval of all Git policies (push and branch policies) that apply to a specific repository and any of its branches, including inherited policies. This eliminates the need for client-side filtering of large datasets and significantly improves the performance of automated Git policy management services, resulting in a 2x reduction in CPU usage and a 10-15x faster execution time.
  4. Azure DevOps MCP Server April UpdateThis post details several updates to the Azure DevOps MCP Server, including the addition of a `wit_query_by_wiql` tool for querying work items using WIQL, the implementation of annotations for tools to enhance LLM safety and reliability, and the addition of previously missing tools like `repo_get_file_content`. It also describes ongoing tool restructuring, starting with wiki tools, and introduces Personal Access Token support and experimental MCP Apps for the local MCP Server.
  5. One-click security scanning and org-wide alert triage come to Advanced SecurityIntroduced CodeQL default setup, allowing one-click enablement of code scanning across repositories, projects, or organizations without manual pipeline configuration. Scans run automatically on Azure Pipelines. Also introduced a combined alerts experience in Security Overview for centralized viewing, searching, and filtering of alerts from all repositories, and security campaigns for coordinating remediation efforts on specific vulnerability types or repository sets.
  7. Retirement of Global Personal Access Tokens in Azure DevOpsAnnounces the retirement of Global Personal Access Tokens (PATs) in Azure DevOps Services, citing security risks associated with broad credential reach. Provides key dates for blocking new global PAT creation/regeneration (December 1, 2026) and full decommissioning of existing global PATs (December 1, 2026). Recommends transitioning to short-lived, Microsoft Entra-backed authentication as a secure alternative. Offers guidance on how to review existing global PATs and outlines recommended actions for users relying on them.
  8. Azure DevOps OAuth Client Secrets Now Shown Only OnceIntroduced a change to Azure DevOps OAuth where client secrets will be shown only once at the time of creation and will no longer be retrievable via the UI or API. This aligns with industry best practices and improves security by reducing the risk of accidental exposure and encouraging secure storage. The Get Registration Secret API will be deprecated and removed. New secret rotation APIs that support overlapping secrets will be available for users who lose access to a secret.
  9. Real-Time Security with Continuous Access Evaluation (CAE) comes to Azure DevOpsIntroduced Continuous Access Evaluation (CAE) support for Azure DevOps, enabling near real-time security enforcement by integrating with Microsoft Entra ID. This allows for rapid revocation of access based on critical security events. The post details the technical mechanism of CAE, its impact on user sessions, considerations for VPN configurations and IP address variability, and the necessary handling of claims challenges for developers using the .NET client library.
  10. Full web support for conditional access policies across Azure DevOps and partner web propertiesThis post announces the integration of Microsoft Entra tokens for web sessions across Azure DevOps services and partner web properties, replacing previous cookie-based authentication. This enables hourly evaluation of conditional access policies, including device compliance, which was not previously supported with the same frequency. Non-interactive flows (e.g., REST API with PATs) will continue to rely on IP-fencing policies.
  11. November patches for Azure DevOps Server and Team Foundation ServerNovember patches for Azure DevOps Server and Team Foundation Server include fixes for service connection edits being persistent after clicking the cancel button.
  12. New Azure DevOps scopes now available for Microsoft Identity OAuth delegated flow appsIntroduced new, granular Azure DevOps scopes for delegated OAuth apps on the Microsoft Identity platform. Previously, only the `user_impersonation` scope was available, granting full access to all Azure DevOps APIs. The new scopes allow apps to request and access only the specific APIs granted by the requested permissions, enhancing security for delegated flows. This brings Azure AD OAuth apps in parity with Azure DevOps OAuth regarding scopes. Existing apps with `user_impersonation` are encouraged to down-scope to reduce risk.
  13. Managed identity and service principal support for Azure DevOps now in General Availability (GA)This post announces the General Availability (GA) of Managed Identity and Service Principal support in Azure DevOps. It details user-facing updates including object-level permission setting across various Azure DevOps objects, extended capabilities for these identities within the Boards space (work item assignment, queries, board configurations, cards, process rules), and the blocking of Azure DevOps OAuth flows for service principals. It also mentions updated documentation and continued welcome for feedback.
  14. Introducing Service Principal and Managed Identity support on Azure DevOpsThis post announces the General Availability of Service Principal and Managed Identity support for authentication in Azure DevOps. It explains the benefits over PATs, such as eliminating single points of failure when users leave and reducing the risk of leaked bearer tokens. It details what Service Principals and Managed Identities are, their availability (Azure AD-backed organizations only), and how Managed Identities offer credential-free access for Azure VMs. It directs users to documentation for getting started.
  15. Azure DevOps client libraries migrated to MSALThis post details the migration of the Microsoft.VisualStudio.Services.InteractiveClient library from ADAL to MSAL for authenticating against Azure Active Directory. It highlights breaking changes, including the shift from ADAL's resources to MSAL's scopes, and provides a helper method for transitioning. It also mentions the removal of ADAL references from Microsoft.TeamFoundationServer.ExtendedClient. Instructions for downloading the latest versions and accessing GitHub samples are provided.
  16. Demystifying Service Principals - Managed IdentitiesThis post clarifies the concepts of Azure AD Service Principals and Managed Identities, explaining their similarities and differences. It details how Service Principals are used for authentication with Azure resources, providing examples with Terraform and Azure DevOps Service Connections, and highlights their challenges such as credential exposure and expiration. It then introduces Managed Identities (System Assigned and User Assigned) as a more secure alternative where credentials are automatically managed and unknown to users. The post provides step-by-step guides for creating and assigning both System Assigned and User Assigned Managed Identities to Azure resources like Virtual Machines and Web Apps, and demonstrates their use in accessing Azure Key Vault.
  17. Deadline extended for connecting VSTS accounts to AzureADThis post announces an extension of the deadline for connecting Visual Studio Team Services (VSTS) accounts to Azure Active Directory (Azure AD). The original deadline of March 31st is extended to the end of September. This change is driven by customer feedback indicating that the migration is perceived as a Microsoft-wide problem and that more time is needed to ensure the complete developer ecosystem remains intact. The post also mentions ongoing work on a technical solution to enable coexistence of Azure AD and MSA identities for VSTS sign-ins.
  18. VSTS will no longer allow creation of new MSA users with custom domain names backed by AzureADThis post announces the deprecation of new Microsoft Account (MSA) sign-ins with custom domain names backed by Azure Active Directory (Azure AD) for Visual Studio Team Services (VSTS). It explains the rationale behind this change, highlighting the lack of central governance for personal MSA accounts and recommending the use of Azure AD accounts for organizational control. The post provides a deadline (March 30th, 2018, later extended to September 2018) and outlines recommended actions for users, primarily connecting their VSTS account to an Azure AD tenant and ensuring all users are members or guests of that tenant.
  19. Automating Azure Resource Group deployment using a Service Principal in Visual Studio Online: Build/Release ManagementDetails the process of connecting Azure subscriptions to Visual Studio Team Services (VSTS) for Azure Resource Manager deployments. It outlines a simplified 3-click setup for creating an Azure Service endpoint with a new Service Principal and provides detailed manual configuration steps using a PowerShell script or the Azure portal to create a Service Principal and assign roles. This enables VSTS to provision or deploy Azure Resource Manager resources.