I cannot create a service connection in AzureDevops

Question

I cannot create a service connection in AzureDevops

Jared Parrish 0

I can no longer create a service connection in Azure Devops. It has been working for years. Every now and then, I have to reset that service connection, but now I cannot create one even though permissions seem fine. It does however let me create one with a managed identity, but wont create a new SPN automatically anymore. New changes I assume. With Managed Identity, service connection still doesnt work with pipeline it seems.

Main error is always 'Authorization failed: Logged in identity is invalid." Please help.

Thanks.

Jared Parrish 0 Reputation points

2026-07-25T22:18:34.6133333+00:00

Also, when I choose recommended options when creating a service connection, it does redirect me to sign in, and it recognizes my subscription but it doesn't show resource groups and pressing 'Save' does NOTHING. so something with SPNs maybe im missing???? Main thing for me is Im using service connection with pipeline to connect to Key vault variables via Library variables. Another note...this is what I have tried and doesnt work at all.......(Azure DevOps → Project Settings → Service connections → New → Azure Resource Manager → Workload Identity federation (automatic)).
Sina Salam 31,296 Reputation points Volunteer Moderator

2026-07-26T19:06:56.8366667+00:00
Hello Jared Parrish,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you cannot create a service connection in AzureDevops.

This is not the service connection name or a normal pipeline configuration issue. Azure DevOps is failing to validate the signed-in identity against the target Microsoft Entra tenant and Azure subscription, or the identity does not have the required permissions to create the app registration/workload identity and assign Azure RBAC access. - https://learn.microsoft.com/en-us/azure/devops/pipelines/release/azure-rm-endpoint?view=azure-devops, and https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops

The best method to fix is to:

Use the exact Microsoft Entra UPN that belongs to the Azure subscription tenant, confirm that the user has Creator or Administrator permission for service connections in Azure DevOps, confirm the user has Owner on the target Azure subscription or required scope, and confirm the user can create app registrations or has an Entra role such as Application Developer, Application Administrator, or Cloud Application Administrator. - https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints?view=azure-devops, https://learn.microsoft.com/en-us/azure/devops/pipelines/policies/service-connection-permissions?view=azure-devops, https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference, and https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged give you deeper insight.

After those permissions are validated, recreate the service connection using Project settings > Service connections > New service connection > Azure Resource Manager > App registration (automatic) > Workload identity federation. Microsoft recommends workload identity federation for ARM service connections because it avoids client secrets and secret rotation. - https://learn.microsoft.com/en-us/azure/devops/pipelines/release/troubleshoot-workload-identity?view=azure-devops

If automatic creation is blocked by tenant policy, do not keep retrying the same wizard. Use a pre-created user-assigned managed identity or a pre-created single-tenant app registration, assign the identity the required Azure RBAC role on the target Azure scope, then configure the Azure DevOps service connection with workload identity federation. If using manual federation, the issuer and subject identifier generated by Azure DevOps must match the federated credential configured on the app registration or managed identity exactly. - https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops, https://learn.microsoft.com/en-us/azure/devops/pipelines/release/troubleshoot-workload-identity?view=azure-devops

If a managed identity service connection was created but the pipeline still fails, that is a second issue. Authorize the pipeline to use the service connection, confirm the service connection is not disabled, confirm the managed identity has RBAC on the actual deployment target scope, and confirm the pipeline task supports workload identity federation. Older task versions and older Azure CLI versions can fail with workload identity federation.

Use the associated resource links for more reading and steps.

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.
Sridevi Machavarapu 33,660 Reputation points Microsoft External Staff Moderator

2026-07-26T20:03:01.47+00:00
Hi Jared Parrish,

Thanks for the detailed information.

From your description, Azure DevOps is able to authenticate you and discover the subscription, but the service connection creation fails when it attempts to complete the authorization.

To help investigate further, could you please provide the following?

What Azure RBAC role do you have on the subscription (for example, Owner or Contributor)?

Are you able to create a service connection using an existing service principal (manual option), or does that fail as well?

When you click Save, do you see any failed requests or error messages in your browser's Developer Tools (F12 → Network or Console)? If so, please share a screenshot or the error details.

This will help determine whether the failure is due to permissions, Microsoft Entra ID, or the service connection creation process itself.
Christos Panagiotidis 3,546 Reputation points

2026-07-27T10:15:33.9366667+00:00

Your symptoms point to failures: automatic workload-identity creation discovers the subscription but cannot authorize it, while the managed-identity connection exists but the pipeline cannot use it. This indicates a tenant or permission mismatch, not a Key Vault variable-group issue.

Sign in with an account in the subscription's Microsoft Entra tenant. Confirm you can administer service connections, create app registrations (or hold Application Developer), and assign Azure roles. Retry Azure Resource Manager > App registration > Workload identity federation.

If automatic creation remains blocked, configure it manually: save a draft, copy its issuer and subject, add an exactly matching federated credential to a single-tenant app registration or user-assigned managed identity, grant the required Key Vault data-plane role, then verify and save. Authorize the pipeline to use it. Microsoft-hosted agents cannot use a VM's system-assigned identity. If Save remains inert, capture the failed request and correlation ID for Azure DevOps Support.

Your answer

Jared Parrish 0 Reputation points

2026-07-25T22:18:34.6133333+00:00

Also, when I choose recommended options when creating a service connection, it does redirect me to sign in, and it recognizes my subscription but it doesn't show resource groups and pressing 'Save' does NOTHING. so something with SPNs maybe im missing???? Main thing for me is Im using service connection with pipeline to connect to Key vault variables via Library variables. Another note...this is what I have tried and doesnt work at all.......(Azure DevOps → Project Settings → Service connections → New → Azure Resource Manager → Workload Identity federation (automatic)).
Sridevi Machavarapu 33,660 Reputation points Microsoft External Staff Moderator

2026-07-26T20:03:01.47+00:00

Hi Jared Parrish,

Thanks for the detailed information.

From your description, Azure DevOps is able to authenticate you and discover the subscription, but the service connection creation fails when it attempts to complete the authorization.

To help investigate further, could you please provide the following?

What Azure RBAC role do you have on the subscription (for example, Owner or Contributor)?

Are you able to create a service connection using an existing service principal (manual option), or does that fail as well?

When you click Save, do you see any failed requests or error messages in your browser's Developer Tools (F12 → Network or Console)? If so, please share a screenshot or the error details.

This will help determine whether the failure is due to permissions, Microsoft Entra ID, or the service connection creation process itself.
Christos Panagiotidis 3,546 Reputation points

2026-07-27T10:15:33.9366667+00:00

Your symptoms point to failures: automatic workload-identity creation discovers the subscription but cannot authorize it, while the managed-identity connection exists but the pipeline cannot use it. This indicates a tenant or permission mismatch, not a Key Vault variable-group issue.

Sign in with an account in the subscription's Microsoft Entra tenant. Confirm you can administer service connections, create app registrations (or hold Application Developer), and assign Azure roles. Retry Azure Resource Manager > App registration > Workload identity federation.

If automatic creation remains blocked, configure it manually: save a draft, copy its issuer and subject, add an exactly matching federated credential to a single-tenant app registration or user-assigned managed identity, grant the required Key Vault data-plane role, then verify and save. Authorize the pipeline to use it. Microsoft-hosted agents cannot use a VM's system-assigned identity. If Save remains inert, capture the failed request and correlation ID for Azure DevOps Support.