Subscription (Service) Connection
What it is
An Azure service connection (historically service endpoint) is the secure, reusable link between Azure DevOps and an Azure subscription that lets pipeline tasks (ARM deploy, Key Vault read, storage, etc.) authenticate to Azure without embedding credentials. Most commonly it’s backed by a service principal created in the target subscription and granted the minimal RBAC the pipeline needs.
Why it exists
A pipeline deploying to Azure must authenticate as something — but embedding username/password or a client secret in the repo or YAML is unacceptable. Service connections wrap an identity (service principal, managed identity, workload identity federation) plus its scope/authorization, and reference it by name in tasks (azureSubscription: $(conn)). This centralizes authentication, enables rotation, and supports least-privilege.
Key ideas
- Approaches: create it interactively (automatic SPN creation), or provide an existing service principal (manual). Workload identity federation is the modern, secret-less option.
- RBAC scope: the SPN is granted role assignments (e.g. Contributor, or check-scoped least-privilege) on a subscription/RG — grants the pipeline those abilities.
- vs. managed identities: inside Azure (e.g. a VM/App Service) prefer a managed identity; from Azure DevOps use a service connection backed by a service principal.
- Security hygiene: separate connections per environment (dev vs prod), least-privilege roles, never share the SPN’s secret in a repo — store in variable group/Key Vault if needed.
- Resource type: an ARM connection is the special Azure Resource Manager connection type; others (Git, Docker, NuGet) are separate service-connection kinds.
How it fits
Service connections are part of secure continuous deployment: they carry the identity and authorization for the deploy tasks, while Azure Key Vault carries the application secrets. Together with environment checks they make each stage deploy under the right identity and the right human sign-off.
Exam notes
- Also called service connection / service endpoint — the
azureSubscriptiontask parameter is a service connection. - Identity model = service principal + RBAC; prefer least-privilege scoped roles.
- Workload identity federation avoids storing a client secret (no secret rotation pain).
- Use separate connections per environment so a compromised dev connection can’t touch prod.
Related
service-principal · rbac · secure-cd · azure-pipelines · secrets-management · environment-approvals