All authentication Method

Azure

AWS Equivalent

Notes

Service Principal (SPN)

IAM User (NOT preferred today)

Has access key + secret (long-lived credentials)

Service Principal with Role Assignment

IAM Role

Best practice for workloads instead of users

Azure WIF (Workload Identity Federation)

Apps exchange an identity token → Azure AD issues credential → access Azure.

AWS Equivalent

IAM Role with OIDC Federation (AssumeRoleWithWebIdentity)

all auth method - services and user

Here is the complete, full, exhaustive list of all authentication methods and all service connection types in Azure DevOps. Nothing missing. This is the master list you can use for study and interviews.

🟦 PART 1 — ALL Authentication Methods in Azure DevOps Pipelines

Azure DevOps supports 12 major authentication mechanisms.

✅ 1. Workload Identity Federation (WIF)

Passwordless authentication using OIDC tokens. Used for ACR, ARM, AKS, Key Vault, Terraform.

✅ 2. Service Principal (Client ID + Secret)

Old but widely used.

Used for:

ACR
ARM
AKS
Key Vault
Azure CLI tasks

✅ 3. Service Principal (Client ID + Certificate)

More secure than secret, used for:

ARM deployments
Key Vault
Terraform

✅ 4. Managed Identity (User-Assigned or System-Assigned)

Used mostly in:

Self-hosted agents running on Azure VM
Pipeline authenticates automatically to Azure

✅ 5. Admin User Authentication (Only for ACR)

Username + password ⚠️ Deprecated and insecure → avoid.

✅ 6. OAuth (Azure AD OAuth)

Used for:

Native apps
Web apps
GitHub integration
Claims-based auth

✅ 7. Personal Access Token (PAT)

Used for:

Git clone/push
REST API
API Automation
Agents authentication

✅ 8. SSH Authentication

Used for:

GitHub connections
Azure Repos SSH access
Linux servers deployment

✅ 9. Basic Authentication

Rare, mostly for:

On-prem systems
Artifactory
Nexus
Jenkins

✅ 10. Token-based authentication (Bearer tokens)

Used by:

Service principals
AAD tokens
Federated tokens

✅ 11. SAS Token Authentication (Storage)

Used for:

Azure Blob Storage
Azure File Shares
Artifacts feed storage

✅ 12. Connection Strings Auth

Used for:

SQL DB
Redis
Service Bus
Event Hub

🟩 PART 2 — ALL Service Connection Types in Azure DevOps

Below is the complete list of all service connections available in Azure DevOps.

🔵 A. Azure Service Connections

Azure Resource Manager (ARM)
- Service Principal
- Managed Identity
- Workload Identity Federation
Azure Container Registry (ACR)
- Service Principal
- Managed Identity
- Workload Identity Federation
- Admin user (legacy)
Azure Classic (ASM)
Azure RM for Kubernetes (AKS)
Azure Key Vault

🟣 B. Git Service Connections

GitHub
- OAuth
- PAT
- SSH
Bitbucket Cloud
Bitbucket Server
GitHub Enterprise
GitLab (via generic)
Azure Repos Git (built-in)

🟠 C. Docker & Container Service Connections

Docker Hub
ACR
Other Container Registry (Harbor, ECR, GCR)

Auth methods:

Username/Password
Service Principal
Managed Identity
WIF

🟥 D. Kubernetes Service Connections

Kubernetes (Generic)
- Kubeconfig
- Service account token
AKS (Azure Integration)
OpenShift

🟤 E. Cloud Provider Connections

AWS Service Connection

Access Key / Secret Key

GCP Service Connection

JSON Key

DigitalOcean Spaces (generic)
Alibaba Cloud (generic)

🟩 F. Artifact, Package & Repo Service Connections

Artifactory
Nexus IQ
JFrog XRay
Sonatype
NuGet.org
Maven repos
NPM registries

🟦 G. CI/CD Tools Integrations

Jenkins
TeamCity
Octopus Deploy
ServiceNow

🟧 H. Monitoring / Security Connections

Snyk
SonarQube
WhiteSource / Mend
Checkmarx
Fortify

🟨 I. Generic Service Connection

Generic Endpoint (REST API) Used to connect to:

Custom APIs
Third-party platforms
Private services
Authentication using PAT, Bearer Token

🟫 J. SCM Connections

Subversion (SVN)
TFS version control

⭐ BONUS — Deprecated / Legacy

XAML Build Services
Azure Classic (ASM)
Legacy Docker Registry with PAT
Basic Auth for Azure (removed)

🏆 Summary (Easy Table)

If you want, I can give you:

✅ A chart/diagram showing how each connection works ✅ Examples of YAML for each service connection ✅ Real-world enterprise CI/CD setup using WIF everywhere Just tell me!

WIF (Workload Identity Federation) OIDC

Below is the complete, correct, up-to-date (2025) guide for setting up and using WIF (Workload Identity Federation) in Azure DevOps.

This includes:

✔ What you must configure in Azure

✔ What you must configure in Azure DevOps

✔ A full working YAML example

✔ Whether the steps are same for ACR, AKS, Key Vault, ARM, etc.

I’ll keep the explanation exact and practical, not theoretical.

🚀 WHAT IS WIF (Workload Identity Federation)?

WIF allows Azure DevOps pipelines to authenticate to Azure without storing secrets.

like aws oidc allow github action to authenticate to ACR without storing secrets.

Instead of storing:

clientId
clientSecret
AWS Cred keys

The pipeline requests a temporary OIDC token, Azure trusts it, and issues an access token.

Github action request OIDC token AWS trust it and issue token

No secrets anywhere. Most secure method today.

🟦 PART 1 — SETUP WIF (Workload Identity Federation) FOR AZURE DEVOPS

⭐ Step 1 — Create an Azure AD App Registration

This app represents Azure DevOps in Azure.

az ad app create --display-name "azuredevops-wif"

Get the app ID:

APP_ID=$(az ad app list --display-name "azuredevops-wif" --query "[0].appId" -o tsv)

⭐ Step 2 — Create a Federated Credential

This allows Azure DevOps pipeline to exchange its OIDC token for an Azure access token.

Replace:

<YOUR-ORG>
<YOUR-PROJECT>
<YOUR-REPO>
main (branch)

az ad app federated-credential create \
  --id $APP_ID \
  --issuer "https://vstoken.dev.azure.com/<YOUR-ORG>/" \
  --subject "repo:<YOUR-ORG>/<YOUR-PROJECT>/<YOUR-REPO>:ref:refs/heads/main" \
  --audience "api://AzureADTokenExchange" \
  --name "azuredevops-wif"

🎯 This is the MOST IMPORTANT PART. Without this, OIDC will not work.

In AWS

Step 1: Create the OIDC Identity Provider in AWS IAM for GitHub. ...

iam role with trust-policy contain issues/principlev ie. github/azure devops and audience

Step 2: Create WebIdentity IAM Role with Trust Policy. ...

Step 3: Add the IAM Role arn to Github

⭐ Step 3 — Give the App permissions (RBAC)

Example: give ACR access.

az role assignment create \
  --role AcrPush \
  --assignee $APP_ID \
  --scope /subscriptions/<SUB>/resourceGroups/<RG>/providers/Microsoft.ContainerRegistry/registries/<ACR_NAME>

You can also grant:

Resource

Role

AKS

Azure Kubernetes Service RBAC Admin

Key Vault

Key Vault Secrets User

Storage

Storage Blob Data Contributor

ARM Deployment

Contributor

🟦 PART 2 — AZURE DEVOPS SETUP

⭐ Step 4 — Create Azure DevOps Service Connection using WIF

Go to:

Azure DevOps → Project Settings → Service Connections → New → Azure Resource Manager → Workload Identity Federation (automatic)

Fill:

Field

Value

Tenant

Your Tenant

Subscription

Your Subscription

App Registration

Select the one you created (azuredevops-wif)

Give it a name:

azure-wif-sc

⭐ Step 5 — Use WIF in pipeline

Here is 100% working OIDC login in ACR using WIF:

pool:
  vmImage: ubuntu-latest

steps:
- task: AzureCLI@2
  inputs:
    azureSubscription: 'azure-wif-sc'
    scriptType: 'bash'
    scriptLocation: 'inlineScript'
    inlineScript: |
      az acr login -n $ACR_NAME
      docker build -t $ACR_NAME.azurecr.io/app:latest .
      docker push $ACR_NAME.azurecr.io/app:latest

No secret. No password. Pipeline uses OIDC token → Azure validates → issues access token.

🟩 Congratulations — WIF is working!

🟦 PART 3 — ARE THE STEPS SAME FOR OTHER CONNECTIONS?

✔ YES — WIF is used the same way for all Azure resources.

You only need to change:

Resource

Role Needed

ACR

AcrPush

AKS

Azure Kubernetes Service RBAC Admin or Contributor

Key Vault

Key Vault Secrets User

Storage Account

Storage Blob Data Contributor

ARM Templates

Contributor

Azure Functions

Contributor

App Service

Contributor

Container Apps

Azure Container Apps Contributor

Everything else stays SAME:

Same App Registration
Same Federated Credential
Same Azure DevOps connection
Same OIDC token exchange flow

✔ So the setup is 90% identical across all Azure resources. Only the RBAC role changes.

🟦 PART 4 — IMPORTANT RULES FOR WIF

🔹 You must use Microsoft-hosted agents

OIDC doesn't work with self-hosted agents yet.

🔹 Service connection must be “ARM (OIDC)”

Not Docker Registry Not generic SPN

🔹 The pipeline must match the `subject` claim

If your federated-credential subject uses:

repo:org/project/repo:ref:refs/heads/main

Then your pipeline must run on main branch.

🔹 One Federated Credential = One repo/branch

For multiple branches, create multiple credentials.

🟦 FINAL SUMMARY

✔ WIF replaces Service Principal secrets

✔ Most secure, recommended approach (2024–2025)

✔ Same setup for ACR, AKS, Key Vault, Storage, etc

✔ Only RBAC permission changes

✔ No secrets or variables needed

✔ Requires Azure DevOps ARM connection

If you want, I can generate:

🔹 WIF + ACR pipeline

🔹 WIF + AKS deployment pipeline

🔹 WIF + Key Vault secret fetch

🔹 WIF + Terraform (AzureRM) authentication

Just tell me: "Give me WIF for (service name)"

Azure recommends rotating SPN secrets every 3–6 months.

WIF tokens are automatically generated and validated.

WIF = Per-Pipeline Identity

You can create:

OIDC identity per repo

Per branch

Per pipeline

This gives zero trust, least privilege.

🛑 5. SPN Allows Broad Permissions

Example: Contributor role → full access.

PreviousContainer and serverless NextService to Service Connection

Last updated 2 months ago

hashtagAzure WIF (Workload Identity Federation)

hashtagAWS Equivalent

hashtag🟦 PART 1 — ALL Authentication Methods in Azure DevOps Pipelines

hashtag✅ 1. Workload Identity Federation (WIF)

hashtag✅ 2. Service Principal (Client ID + Secret)

hashtag✅ 3. Service Principal (Client ID + Certificate)

hashtag✅ 4. Managed Identity (User-Assigned or System-Assigned)

hashtag✅ 5. Admin User Authentication (Only for ACR)

hashtag✅ 6. OAuth (Azure AD OAuth)

hashtag✅ 7. Personal Access Token (PAT)

hashtag✅ 8. SSH Authentication

hashtag✅ 9. Basic Authentication

hashtag✅ 10. Token-based authentication (Bearer tokens)

hashtag✅ 11. SAS Token Authentication (Storage)

hashtag✅ 12. Connection Strings Auth

hashtag🟩 PART 2 — ALL Service Connection Types in Azure DevOps

hashtag🔵 A. Azure Service Connections

hashtag🟣 B. Git Service Connections

hashtag🟠 C. Docker & Container Service Connections

hashtag🟥 D. Kubernetes Service Connections

hashtag🟤 E. Cloud Provider Connections

hashtag🟩 F. Artifact, Package & Repo Service Connections

hashtag🟦 G. CI/CD Tools Integrations

hashtag🟧 H. Monitoring / Security Connections

hashtag🟨 I. Generic Service Connection

hashtag🟫 J. SCM Connections

hashtag⭐ BONUS — Deprecated / Legacy

hashtag🏆 Summary (Easy Table)

hashtagIf you want, I can give you:

hashtag✔ What you must configure in Azure

hashtag✔ What you must configure in Azure DevOps

hashtag✔ A full working YAML example

hashtag✔ Whether the steps are same for ACR, AKS, Key Vault, ARM, etc.

hashtag🚀 WHAT IS WIF (Workload Identity Federation)?

hashtag🟦 PART 1 — SETUP WIF (Workload Identity Federation) FOR AZURE DEVOPS

hashtag⭐ Step 1 — Create an Azure AD App Registration

hashtag⭐ Step 2 — Create a Federated Credential

hashtag⭐ Step 3 — Give the App permissions (RBAC)

hashtag🟦 PART 2 — AZURE DEVOPS SETUP

hashtag⭐ Step 4 — Create Azure DevOps Service Connection using WIF

hashtag⭐ Step 5 — Use WIF in pipeline

hashtag🟩 Congratulations — WIF is working!

hashtag🟦 PART 3 — ARE THE STEPS SAME FOR OTHER CONNECTIONS?

hashtag✔ YES — WIF is used the same way for all Azure resources.

hashtag🟦 PART 4 — IMPORTANT RULES FOR WIF

hashtag🔹 You must use Microsoft-hosted agents

hashtag🔹 Service connection must be “ARM (OIDC)”

hashtag🔹 The pipeline must match the subject claim

hashtag🔹 One Federated Credential = One repo/branch

hashtag🟦 FINAL SUMMARY

hashtag✔ WIF replaces Service Principal secrets

hashtag✔ Most secure, recommended approach (2024–2025)

hashtag✔ Same setup for ACR, AKS, Key Vault, Storage, etc

hashtag✔ Only RBAC permission changes

hashtag✔ No secrets or variables needed

hashtag✔ Requires Azure DevOps ARM connection

hashtagIf you want, I can generate:

hashtag🔹 WIF + ACR pipeline

hashtag🔹 WIF + AKS deployment pipeline

hashtag🔹 WIF + Key Vault secret fetch

hashtag🔹 WIF + Terraform (AzureRM) authentication

Azure WIF (Workload Identity Federation)

AWS Equivalent

🟦 PART 1 — ALL Authentication Methods in Azure DevOps Pipelines

✅ 1. Workload Identity Federation (WIF)

✅ 2. Service Principal (Client ID + Secret)

✅ 3. Service Principal (Client ID + Certificate)

✅ 4. Managed Identity (User-Assigned or System-Assigned)

✅ 5. Admin User Authentication (Only for ACR)

✅ 6. OAuth (Azure AD OAuth)

✅ 7. Personal Access Token (PAT)

✅ 8. SSH Authentication

✅ 9. Basic Authentication

✅ 10. Token-based authentication (Bearer tokens)

✅ 11. SAS Token Authentication (Storage)

✅ 12. Connection Strings Auth

🟩 PART 2 — ALL Service Connection Types in Azure DevOps

🔵 A. Azure Service Connections

🟣 B. Git Service Connections

🟠 C. Docker & Container Service Connections

🟥 D. Kubernetes Service Connections

🟤 E. Cloud Provider Connections

🟩 F. Artifact, Package & Repo Service Connections

🟦 G. CI/CD Tools Integrations

🟧 H. Monitoring / Security Connections

🟨 I. Generic Service Connection

🟫 J. SCM Connections

⭐ BONUS — Deprecated / Legacy

🏆 Summary (Easy Table)

If you want, I can give you:

✔ What you must configure in Azure

✔ What you must configure in Azure DevOps

✔ A full working YAML example

✔ Whether the steps are same for ACR, AKS, Key Vault, ARM, etc.

🚀 WHAT IS WIF (Workload Identity Federation)?

🟦 PART 1 — SETUP WIF (Workload Identity Federation) FOR AZURE DEVOPS

⭐ Step 1 — Create an Azure AD App Registration

⭐ Step 2 — Create a Federated Credential

⭐ Step 3 — Give the App permissions (RBAC)

🟦 PART 2 — AZURE DEVOPS SETUP

⭐ Step 4 — Create Azure DevOps Service Connection using WIF

⭐ Step 5 — Use WIF in pipeline

🟩 Congratulations — WIF is working!

🟦 PART 3 — ARE THE STEPS SAME FOR OTHER CONNECTIONS?

✔ YES — WIF is used the same way for all Azure resources.

🟦 PART 4 — IMPORTANT RULES FOR WIF

🔹 You must use Microsoft-hosted agents

🔹 Service connection must be “ARM (OIDC)”

🔹 The pipeline must match the `subject` claim

🔹 One Federated Credential = One repo/branch

🟦 FINAL SUMMARY

✔ WIF replaces Service Principal secrets

✔ Most secure, recommended approach (2024–2025)

✔ Same setup for ACR, AKS, Key Vault, Storage, etc

✔ Only RBAC permission changes

✔ No secrets or variables needed

✔ Requires Azure DevOps ARM connection

If you want, I can generate:

🔹 WIF + ACR pipeline

🔹 WIF + AKS deployment pipeline

🔹 WIF + Key Vault secret fetch

🔹 WIF + Terraform (AzureRM) authentication