DevOps / SRE / Platform · 06.08.2026, 11:53 UTC
You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token
| Schweregrad | info |
|---|---|
| Kategorie | DevOps / SRE / Platform |
| Quelle | Azure DevOps Blog ↗ |
| Veröffentlicht | 06.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
We’re excited to announce the Azure DevOps service connection, a new way to access Azure DevOps from your pipelines using a Microsoft Entra workload identity (a service principal or managed identity) instead of a Personal Access Token (PAT) or session token. This post walks through what it is, how to set it up, and the many places you can use it, including several capabilities we’ve added based on your feedback. Why use an Azure DevOps service connection? Using an Azure DevOps service connection improves the security of your pipelines in several ways:
PAT-free authentication: Eliminate the need to create, store, and rotate Personal Access Tokens Least privilege: Use per-pipeline or even task-level permissions instead of shared build service account permissions No persistent secrets: Use Microsoft Entra federated credentials instead of passwords Audit trail: All authentication attempts are logged in the Azure DevOps audit log
Because the connection authenticates as a Microsoft Entra identity, you can also use it to reach resources in another Azure DevOps organization that’s joined to the same Entra ID tenant. Configuring an Azure DevOps service connection
Important pre-requisite The service connection creation experience does not create an identity in Entra or user in Azure DevOps. Both are a pre-requisite to creating the new Azure DevOps service connection. Before you create a service connection, first add a service principal or managed identity as a user in the organization and assign it the permissions it needs.
After you added a service principal or managed identity …