You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token

This post introduces the Azure DevOps service connection, a new authentication mechanism for pipelines that leverages Microsoft Entra workload identities (service principals or managed identities) instead of PATs or session tokens. It details the benefits of this approach, including enhanced security through PAT-free authentication, least privilege, no persistent secrets, and an audit trail. The post provides step-by-step instructions for configuring the service connection, including prerequisites and manual configuration fallbacks. It also demonstrates various use cases, such as accessing repositories and YAML templates from other organizations, interacting with artifact feeds, calling Azure DevOps REST APIs via the Invoke REST API task, and using the Azure CLI with the new connection type for secret-less operations and Entra token acquisition.