|
| 1 | +This section gives you an overview of how to set up a managed identity and use it for an OIDC-based service connection in Azure DevOPs |
| 2 | + |
| 3 | +### _Navigation_ |
| 4 | +- [Create Service Connection (Part 1)](#create-service-connection-part-1) |
| 5 | +- [Create managed identity](#create-managed-identity) |
| 6 | +- [Create federated credential](#create-federated-credential) |
| 7 | +- [Create Service Connection (Part 2)](#create-service-connection-part-2) |
| 8 | + |
| 9 | +# Create Service Connection (Part 1) |
| 10 | + |
| 11 | +1. To start the setup, navigate to the 'Service connections' of your 'Project Settings' and select 'New service connection' |
| 12 | + |
| 13 | + <img src="./media/oidc/serviceConnection-init.png" alt="Init service connection" height="300"> |
| 14 | + |
| 15 | +1. Next, select 'Azure Resource Manager' as the service connection type and click on 'Next' |
| 16 | + |
| 17 | + <img src="./media/oidc/serviceConnection-type.png" alt="Select service connection type" height="300"> |
| 18 | + |
| 19 | +1. When asked which type of authentication you'd like to use, select 'Workload Identity Federation (manual)' |
| 20 | + |
| 21 | + <img src="./media/oidc/serviceConnection-authentication.png" alt="Select service connection authentication" height="350"> |
| 22 | + |
| 23 | +1. Finally, give the to-be service connection a name, and select 'Next' one last time (for now) |
| 24 | + |
| 25 | + <img src="./media/oidc/serviceConnection-name.png" alt="Select service connection name" height="450"> |
| 26 | + |
| 27 | +1. In this following view, take not of the 'Issuer' & 'Subject identifier' values. You'll need those to create the federated credential |
| 28 | + |
| 29 | + <img src="./media/oidc/serviceConnection-issuer.png" alt="Select service connection issuer info" height="350"> |
| 30 | + |
| 31 | +# Create managed identity |
| 32 | + |
| 33 | +With the service connection prepared, we can now move on the the Managed Identity in Azure |
| 34 | + |
| 35 | +1. To start, navigate to the Managed Identity overview and select '+ Create' |
| 36 | + |
| 37 | + <img src="./media/oidc/managedIdentityCreate.png" alt="Init MSI creation" height="200"> |
| 38 | + |
| 39 | +1. Next, provide the required information like the resource group, name & location and initialize the creation by selecting the 'Review + create', followed by another click on the 'Create' button |
| 40 | + |
| 41 | + <img src="./media/oidc/managedIdentityDetails.png" alt="MSI details" height="450"> |
| 42 | + |
| 43 | +1. Once the resource is created, navigate to it so that we can start creating the federated credential. Also, take note of the 'Client ID' in the resource's overview which we will need again to finish up the Service Connection creation later. |
| 44 | + |
| 45 | + <img src="./media/oidc/managedIdentityId.png" alt="MSI details" height="300"> |
| 46 | + |
| 47 | +# Create federated credential |
| 48 | + |
| 49 | +1. On the managed identity resource, select 'Federated credentials' in the resource blade, followed by '+ Add Credential' |
| 50 | + |
| 51 | + <img src="./media/oidc/credentialInit.png" alt="Init credential" height="350"> |
| 52 | + |
| 53 | +1. Now, for the |
| 54 | + - 'Federated credential scenario', select '**Other** Configure an identity managed by an external OpenID Connect Provider to access Azure resources as this application' |
| 55 | + - 'Issuer Url' provide the 'Issuer' value from the last step in the preceding Service Connection creation |
| 56 | + - 'Subject identifier' provide the 'Subject identifier' value from the last step in the preceding Service Connection creation |
| 57 | + - Name, a name of your choice |
| 58 | + |
| 59 | + <img src="./media/oidc/credentialDetails.png" alt="Credential details" height="500"> |
| 60 | + |
| 61 | +1. Finally, finish the creation of the Federated Credential by selecting 'Add' |
| 62 | + |
| 63 | +# Create Service Connection (Part 2) |
| 64 | + |
| 65 | +Now, with the federated credential ready, we can return to the creation of the Service Connection to wrap it up. To do so, |
| 66 | + |
| 67 | +1. Provide all required details in the Service connection's form, including |
| 68 | + - Subscription ID: Must be the Subscription ID of the Subscription containing the created Managed Identity |
| 69 | + - Subscription Name: The name of the Subscription |
| 70 | + - Service Principal Id: The client ID of the created Managed Identity, taken from its overview page. **Note:** This refers to the Client ID, not the Object / Principal ID |
| 71 | + - Tenant ID: The ID of the Tenant containing the created Managed Identity |
| 72 | + |
| 73 | + <img src="./media/oidc/serviceConnection-finish.png" alt="Service Connection finish" height="700"> |
| 74 | + |
| 75 | +1. Finally, select 'Verify and save' and you should be good to go to use the Service Connection in your pipelines. |
| 76 | + |
| 77 | + > **NOTE:** Don't forget to grant your Managed Identity the permissions it needs to perform its tasks (e.g., create resources) |
0 commit comments