Unable to Create Service Connection for ARM Deployment Using Azure Education Credit via Azure DevOps IaC

Question

Unable to Create Service Connection for ARM Deployment Using Azure Education Credit via Azure DevOps IaC

Julie M 551

Hello,

I have an Azure Education Credit ($1000) assigned to my work account. Upon activation, it was linked to work account, where I created a new subscription and set up my demo environment (e.g., Azure DevOps, databricks).

Now, I’m facing an issue while trying to create a Azure devops Service Connection for ARM deployment to deploy IaC components. The error seems to be related to app registration issues.

My subscription is under my work account's tenant, which I cannot modify.

Tried using Managed Identity, but it did not work.

Unable to create a Service Principal as registration fails.

When attempting to use az login, I receive the following error:

vbnet
CopyEdit
Initializing the backend...
╷
│ Error: Error building ARM Config: obtain subscription() from Azure CLI: parsing json result from the Azure CLI: waiting for the Azure CLI: exit status 1: ERROR: Please run 'az login' to setup account.
│
│

Has anyone encountered this issue before? How can I proceed with setting up the Service Connection for ARM deployment given the restrictions on the tenant? Any workarounds or best practices would be greatly appreciated.

Thanks in advance!

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T10:55:03.1466667+00:00

The Education Credit subscription is not itself the cause of the Terraform Please run az login error. That message means Terraform is trying to use the local Azure CLI identity, while the pipeline has not authenticated that process. A pipeline service connection should provide the identity instead.

Create an Azure Resource Manager service connection using workload identity federation with either a user-assigned managed identity or an app registration. The setup requires Azure DevOps service-connection administration, permission to add a federated credential, and permission to grant the identity an Azure role. Create the identity, save the service connection as a draft, copy its issuer and subject into the federated credential, assign only the required role—preferably at resource-group scope—then verify and save the connection. Run Terraform inside a task that references that service connection, such as an Azure CLI task, rather than relying on an unauthenticated local az session. If tenant policy prevents identity creation or role assignment, the tenant administrator must perform those steps.
Sina Salam 31,296 Reputation points Volunteer Moderator

2026-07-29T15:32:07.1166667+00:00
Hello Julie M,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are unable to Create Service Connection for ARM Deployment Using Azure Education Credit via Azure DevOps IaC.

The failure is caused by Microsoft Entra tenant restrictions preventing Azure DevOps from automatically creating or configuring the required app registration/service principal for the ARM service connection. Azure DevOps ARM service connections require a trusted identity, and Microsoft recommends using Workload Identity Federation with either an app registration or a user-assigned managed identity. - https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops

The best method to resolve is to:

Use App registration or Managed identity (manual) with Workload Identity Federation in Azure DevOps.

Ask the work tenant/subscription administrator to create or approve the required identity.

Add the Azure DevOps-generated Issuer and Subject identifier as a federated credential on that identity.

Assign the identity the required Azure RBAC role, such as Contributor, on the target resource group or subscription.

Run Terraform through an Azure DevOps AzureCLI@2 task using the completed ARM service connection.

If the tenant administrator will not create or delegate the required identity, there is no supported workaround from Azure DevOps because the deployment identity must exist and be trusted in the Microsoft Entra tenant that owns the subscription. Microsoft documents that when application registration is restricted, an administrator must grant the required permission, create the application, or assign the user as owner. - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-app-roles

Use the below resources for more reading and implementation guidance:

https://learn.microsoft.com/azure/devops/pipelines/release/configure-workload-identity

https://learn.microsoft.com/azure/developer/terraform/authenticate-to-azure

https://learn.microsoft.com/azure/devops/pipelines/tasks/reference/azure-cli-v2

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T10:55:03.1466667+00:00

The Education Credit subscription is not itself the cause of the Terraform Please run az login error. That message means Terraform is trying to use the local Azure CLI identity, while the pipeline has not authenticated that process. A pipeline service connection should provide the identity instead.

Create an Azure Resource Manager service connection using workload identity federation with either a user-assigned managed identity or an app registration. The setup requires Azure DevOps service-connection administration, permission to add a federated credential, and permission to grant the identity an Azure role. Create the identity, save the service connection as a draft, copy its issuer and subject into the federated credential, assign only the required role—preferably at resource-group scope—then verify and save the connection. Run Terraform inside a task that references that service connection, such as an Azure CLI task, rather than relying on an unauthenticated local az session. If tenant policy prevents identity creation or role assignment, the tenant administrator must perform those steps.