Quick Notes104 words
Azure DevOps service connections and PATs — quick notes
Service connections and PATs — quick notes
| Item | Detail |
|---|---|
| Current ARM pattern | Workload identity federation — no stored secret |
| Deprecation | Azure DevOps issuer → convert to Microsoft Entra issuer |
| Conversion guidance | Convert the existing connection, don't replace it |
| Authorisation | Authorise each pipeline individually, not "all pipelines" |
| Service connection is | A protected resource — can carry checks |
| PAT | A user credential — minimal scope, short expiry |
Trap: "grant access to all pipelines" lets any pipeline in the project use your production credential.