Azure Learning

Service connections for deployments

Properties1
tagsaz-400, module, release, identity, connections

2 min read

Service Connections for Deployments

MS Learn path: Design and implement a release strategy — deepen module 9.

Overview

How a pipeline authenticates to Azure to deploy: managed service connections (Azure Pipelines → Azure, GitHub Actions → cloud), secured by workload identity federation (OIDC) or scoped secrets, and how identity provisioning (SCIM) keeps those principals aligned with org roles and least privilege.

Units

  • Managed service connections for deploy (Azure DevOps, GitHub)
  • Securing them with workload identity federation / OIDC
  • Provisioning identities & roles for least privilege (SCIM / RBAC)

Concepts introduced

Key terms

  • Managed service connection — a stored, purpose-scoped credential a pipeline uses to call Azure (Azure DevOps service connection, GitHub OAuth or PAT).
  • Workload identity federation — exchange an OIDC token for a scoped, short-lived Azure token; no static secret.
  • SCIM — standardized user/group provisioning keeps principals in sync for governance.

Hands-on

⚠ verify — add: configure a service connection + workload identity federation, then deploy with no stored secret.

Exam focus

  • Prefer workload identity federation (OIDC) over static PAT/client secrets for pipeline→cloud auth.
  • Service connections are scoped, least-privilege, auditable — not admin-shared credentials.
  • SCIM/role provisioning keeps identities aligned as the org changes.

workload-identity-federation · service-principal · key-vault · azure-pipelines · Path MOC

Graph View

Backlinks