Using workload identity federation in Azure pipelines

Deployment pipelines need an identity to access Azure. Where supported, workload identity federation can replace a stored client secret with a trust relationship and short-lived access tokens.

Microsoft's workload identity federation guidance describes the approach and supported scenarios.

Authentication and permissions are separate

Changing how a pipeline signs in does not change what it is authorised to do. Review its role assignments and scope them to the resources and operations the job needs.

Keep production and non-production responsibilities clear, and review who can change the pipeline and its trust configuration.

Plan the change around the environment

Check the capabilities of your pipeline platform, tasks and tools. Test the authentication flow and agree how the change will be introduced.

The result should be a documented identity and permission model that the team can maintain. The implementation and effort depend on the existing pipeline and access requirements.