Create Federated service connection for Docker/ACR type through Azure DevOps CLI service endpoint.

Question

I am trying to create a service connection in DevOps of type **New Docker Registry service connection to the ACR (Azure Container Registry). **

I am trying to do it in a powershell script. Below is the request body I use in my powershell script.

$uri = "https://dev.azure.com/$($organization)/$($projectName)/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4"
# Construct the request body
$requestBody = @{
    name                             = "DockerAcrTest1"
    type                             = "dockerregistry"
    url                              = "https://$($acrLoginServer)"
    authorization                    = @{
        parameters = @{
            loginServer        = $acrLoginServer
            role               = "8311e382-0749-4cb8-b61a-304f252e45ec"
            scope              = $acrRegistryId
            servicePrincipalId = "<placeholder>"
            tenantId           = $tenantId
        }
        scheme     = "ServicePrincipal"
    }
    data                             = @{
        registryId       = $acrRegistryId
        registrytype     = "ACR"
        subscriptionId   = $subscriptionId
        subscriptionName = $subscriptionName
    }
    serviceEndpointProjectReferences = @(
        @{
            projectReference = @{
                id   = $projectId
                name = $projectName
            }
            name             = $serviceConnectionName # This will be the name seen in the Service Connections for the project
        }
    )

This creates a service connection but also creates an app registration that I dont want in the entra. I would much rather want the new workload identity connection and use a pre existing service principal or app registration than create a default new one. But I am having a hard time deducing the request for such a method as the documentation is very sparse.

https://learn.microsoft.com/en-us/azure/devops/cli/service-endpoint?view=azure-devops

https://github.com/Azure/azure-cli-extensions/issues/1495

Answer 1

Hi Yashas Manjunath

To create a federated service connection manually, the schema must include:

  "authorization": {
    "scheme": "WorkloadIdentityFederation",
    "parameters": {
      "clientId": "<your-app-registration-or-managed-identity-client-id>",
      "tenantId": "<your-tenant-id>"
    }

Here the "scheme": "WorkloadIdentityFederation" and the clientId must match the federated identity credential in Entra.

You’ll need to manually set up the federated credential using issuer and subject.

Issuer - https://vstoken.dev.azure.com/<your-org-id>/ - You will get the organization id from your Azure DevOps URL.

Subject - sc://<organization-name>/<project-name>/<service-connection-name> - You will get your actual DevOps org, project, and connection names.

Once you have these, go to Microsoft Entra -> App registrations -> Your App > Federated credentials, and create a new credential using:

• Issuer: as above
• Subject: as above
• Audience: api://AzureADTokenExchange

Example:

az ad app federated-credential create \
  --id <service-principal-object-id> \
  --parameters '{
    "name": "ado-acr-federation",
    "issuer": "https://vstoken.dev.azure.com/<org-id>/",
    "subject": "repo:<org>/<project>/<repo>:ref:refs/heads/main",
    "audiences": ["api://AzureADTokenExchange"]
  }'

Hope this helps!

Please Let me know if you have any queries.

Answer 2

Thanks for the response. I am really trying to create a workload idenenty federated service connection. What is the schema that I need which lets me do this?

In the Alternate step you have mentioned above, It says create a new federated credential on the App service I want. Where will i get the issuer and value details from. The DevOps does not tell me this information.

Answer 3

Hi Yashas Manjunath

Yes, if you're using the UsernamePassword authentication scheme with a service principal for your Azure Container Registry (ACR) service connection, you must assign the appropriate roles to that service principal. Required roles can be AcrPush, AcrPull or Owner.

Hope this helps!

Please Let me know if you have any queries.

Answer 4

@Durga Reshma Malthi With the UsernamePassword schema created service connection do I also need to assign the service principal with ACR push and Pull add role assignments on the ACR later for it to work ?

Is there also a direct schema for Workload Identity Federation so I can just directly configure an existing service connection which is workload type all in one request to DevOps?

Answer 5

Hi Yashas Manjunath

To create a Docker Registry service connection to Azure Container Registry (ACR) without generating a new app registration, you can use a workload identity connection with an existing service principal.

Instead of letting DevOps auto-create the app registration, you can manually configure the service connection using the UsernamePassword scheme.

$requestBody = @{
    name  = "DockerAcrWithSP"
    type  = "dockerregistry"
    url   = "https://$acrLoginServer"
    authorization = @{
        scheme = "UsernamePassword"
        parameters = @{
            registry = "https://$acrLoginServer"
            username = $servicePrincipalId  # Application (client) ID
            password = $clientSecret        # Secret from Entra ID
            email    = "unused@example.com"
        }
    }
    data = @{
        registrytype = "Others"
    }
    serviceEndpointProjectReferences = @(
        @{
            projectReference = @{
                id   = $projectId
                name = $projectName
            }
            name = "DockerAcrWithSP"
        }
    )
}

Alternatively, you can create a federated credential in your existing app registration:

• Go to Microsoft Entra ID -> App registrations -> Your App > Federated credentials -> Add a new credential using the issuer and subject identifier from DevOps
• Create the service connection in DevOps manually:
  • Use the REST API or UI to create a Docker Registry connection
  • Choose Workload Identity Federation as the authentication method

Additional References:

https://learn.microsoft.com/en-us/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops&tabs=managed-identity

Hope this helps!

Please Let me know if you have any queries