Introducing Azure DevOps ID Token Refresh and Terraform Task Version 5

This post introduces ID Token Refresh capability for Workload identity federation with Azure DevOps and Terraform. It details the mechanism of ID Token Refresh, which allows tasks to obtain new ID Tokens when existing ones expire, preventing authentication errors like `AADSTS700024`. The post highlights that this required updates to the `azurerm`, `azapi`, and `azuread` Terraform providers, as well as the `azurerm` backend for Terraform CLI. It also announces version 5 of the Microsoft DevLabs Terraform Task, which supports ID Token Refresh by default, abstracting the configuration complexity. For users not using the DevLabs task, it outlines the necessary environment variables (`ARM_OIDC_AZURE_SERVICE_CONNECTION_ID`, `ARM_OIDC_REQUEST_URL`, `ARM_OIDC_REQUEST_TOKEN`) and provides an example using the Azure CLI task.
More from the Azure DevOps Workload Identity Federation with Terraform trail
- Retirement of Azure DevOps issuer in Workload identity federation service connections
- Workload identity federation for Azure deployments is now generally available
- Managed identity and service principal support for Azure DevOps now in General Availability (GA)
- Introduction to Azure DevOps Workload identity federation (OIDC) with Terraform
- Public preview of Workload identity federation for Azure Pipelines