TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Azure DevOps Workload Identity Federation with Terraform

7 posts · Jan 2021 – Jun 2026

What this trail covers

Azure DevOps continues to enhance its Kubernetes deployment capabilities by improving service connection management. This evolution addresses limitations with traditional Kubernetes Service Connections, especially for private AKS clusters or those with local accounts disabled. The introduction and expanded support for Azure Resource Manager (ARM) Service Connections in Kubernetes tasks (AzureFunctionOnKubernetes, KubernetesManifest, HelmDeploy, Kubernetes) provide a more robust and secure method. This thread now tracks the evolution of Workload identity federation (OpenID Connect) with Azure DevOps and Terraform, introducing ID Token Refresh capability by default in the Microsoft DevLabs Terraform Task version 5. This capability allows running tasks to request a new ID Token and exchange it for an access token when the previous token has expired, addressing issues like `AADSTS700024: Client assertion is not within its valid time range` during long-running jobs or breaks. This required updates to the azurerm, azapi, and azuread providers, as well as the azurerm backend for Terraform CLI.

All Microsoft trails
  1. Retirement of Azure DevOps issuer in Workload identity federation service connectionsAnnounces the deprecation and upcoming retirement of the Azure DevOps issuer (`https://vstoken.dev.azure.com`) for workload identity federation (WIF) service connections, with a retirement date of July 1, 2027. This change aligns with Microsoft's initiative to standardize on the Microsoft Entra issuer (`https://login.microsoftonline.com/`) across Azure services. New service connections have used the Microsoft Entra issuer by default since November 2025. Existing connections using the Azure DevOps issuer will receive warnings starting July 2026 and will cease to be supported on July 1, 2027. Provides instructions for converting existing service connections to use the Microsoft Entra issuer and addresses FAQs regarding the transition.
  2. Introducing Azure DevOps ID Token Refresh and Terraform Task Version 5This post introduces ID Token Refresh capability for Workload identity federation with Azure DevOps and Terraform. It details the mechanism of ID Token Refresh, which allows tasks to obtain new ID Tokens when existing ones expire, preventing authentication errors like `AADSTS700024`. The post highlights that this required updates to the `azurerm`, `azapi`, and `azuread` Terraform providers, as well as the `azurerm` backend for Terraform CLI. It also announces version 5 of the Microsoft DevLabs Terraform Task, which supports ID Token Refresh by default, abstracting the configuration complexity. For users not using the DevLabs task, it outlines the necessary environment variables (`ARM_OIDC_AZURE_SERVICE_CONNECTION_ID`, `ARM_OIDC_REQUEST_URL`, `ARM_OIDC_REQUEST_TOKEN`) and provides an example using the Azure CLI task.
  3. Workload identity federation for Azure deployments is now generally availableThis post announces the general availability of workload identity federation for Azure service connections in Azure DevOps. It highlights the improved security benefits, such as stricter identity usage enforcement and elimination of expiring secrets, and provides instructions for creating new service connections with this feature or converting existing ones that use secrets. A PowerShell script is also included to facilitate bulk conversion.
  4. Managed identity and service principal support for Azure DevOps now in General Availability (GA)This post announces the General Availability (GA) of Managed Identity and Service Principal support in Azure DevOps. Key updates include the ability to set object-level permissions on service principals and managed identities across various Azure DevOps objects (Agent Pools, Feeds, Packages, Service Connections, etc.). Support for service principals has been extended within the Boards space, allowing them to be assigned to work items, used in queries, and configured in boards' settings and cards. Azure DevOps OAuth flows are now blocked for service principals and managed identities to align with the Microsoft Identity platform.
  5. Introduction to Azure DevOps Workload identity federation (OIDC) with TerraformThis post details the configuration and usage of Workload Identity Federation (OIDC) with Terraform in Azure DevOps. It explains why to use it, how it works by establishing a trust between Azure DevOps and an Azure service principal using OpenID Connect, and how to configure it using the Azure DevOps Terraform provider. It also shows how to use it in an Azure DevOps Pipeline with the Terraform task, highlighting that the implementation is abstracted away into the choice of Service Connection type.
  7. Public preview of Workload identity federation for Azure PipelinesThis post announces the public preview of workload identity federation for Azure service connections, which uses OpenID Connect (OIDC) to simplify authentication between Azure Pipelines and Azure. It eliminates the need to manage expiring secrets and improves security by using a federation subject. The post details how to convert existing service connections or create new ones using this scheme, and lists updated built-in Azure Pipelines tasks that support it. It also provides guidance for custom tasks and extensions, including Terraform integration.
  8. Service Connection guidance for AKS customers using Kubernetes tasksThis post introduces and details the use of Azure Resource Manager (ARM) Service Connections for Azure DevOps Kubernetes tasks (AzureFunctionOnKubernetes, KubernetesManifest, HelmDeploy, Kubernetes) when targeting Azure Kubernetes Service (AKS). It explains the limitations of the Kubernetes Service Connection type for private clusters or clusters with local accounts disabled, particularly due to Kubernetes' move away from long-lived tokens. The ARM Service Connection approach defers connectivity to pipeline runtime, allowing for short-lived tokens and better integration with private clusters and Azure AD RBAC via `kubelogin`.
  9. Demystifying Service Principals - Managed IdentitiesThis post clarifies the concepts of Service Principals and Managed Identities in Azure AD. It explains that Service Principals are application identities used for authentication to Azure resources, often replacing 'fake users' and can be restricted by RBAC roles. It highlights challenges with Service Principals like credential exposure and expiration. Managed Identities are then introduced as a more secure and automated alternative, being Service Principals linked to Azure Resources. The post details System Assigned and User Assigned Managed Identities, demonstrating their creation and assignment via the Azure Portal and their use in granting permissions to Azure Key Vault. It emphasizes that Managed Identities eliminate the need for manual credential management and reduce security risks.