Microsoft

Introducing Azure DevOps ID Token Refresh and Terraform Task Version 5

May 2, 2025Jared Holgate
Introducing Azure DevOps ID Token Refresh and Terraform Task Version 5
SummaryAI, from the source post

This post introduces ID Token Refresh capability for Workload identity federation with Azure DevOps and Terraform. It details the mechanism of ID Token Refresh, which allows tasks to obtain new ID Tokens when existing ones expire, preventing authentication errors like `AADSTS700024`. The post highlights that this required updates to the `azurerm`, `azapi`, and `azuread` Terraform providers, as well as the `azurerm` backend for Terraform CLI. It also announces version 5 of the Microsoft DevLabs Terraform Task, which supports ID Token Refresh by default, abstracting the configuration complexity. For users not using the DevLabs task, it outlines the necessary environment variables (`ARM_OIDC_AZURE_SERVICE_CONNECTION_ID`, `ARM_OIDC_REQUEST_URL`, `ARM_OIDC_REQUEST_TOKEN`) and provides an example using the Azure CLI task.

More from the Azure DevOps Workload Identity Federation with Terraform trail