Synapse Workspace Deployment v2.5.0 Fails with Azure DevOps Federated Service Connection

Question

We're attempting to deploy Synapse artifacts through Azure DevOps using the Synapse workspace deployment@2 task (version 2.5.0) and an Azure Resource Manager service connection configured with Workload Identity Federation (OIDC/Federated Credentials).

Environment

• Azure DevOps Pipeline
• Synapse Workspace Deployment Extension v2.5.0 (latest available version)
• Azure RM Service Connection using Workload Identity Federation
• Target workspace: [provided if needed]

Observed Behavior

The deployment fails during the Synapse workspace deployment@2 task with:

Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

The failure occurs before artifact deployment begins.

Evidence that Authentication is Working

The exact same federated service connection successfully authenticates in Azure CLI tasks within the same pipeline:

Shell

1

az login --service-principal --federated-token ...

Show more lines

The pipeline is able to:

• Authenticate to Azure successfully
• Retrieve subscription context
• Execute Synapse CLI commands
• List Synapse triggers
• Stop Synapse triggers successfully

The following Azure CLI task succeeds using the same service connection:

Shell

1

az synapse trigger list --workspace-name [if needed]

2

az synapse trigger stop --workspace-name [if needed] --name <trigger>

Show more lines

This indicates:

• Federated credential configuration is valid
• Azure DevOps OIDC token issuance is working
• Azure RBAC access is working
• Synapse permissions are present

Question

Does Synapse workspace deployment@2 (v2.5.0) support Azure DevOps Workload Identity Federation service connections?

The behavior suggests the deployment extension may not be able to consume federated credentials even though Azure CLI tasks in the same pipeline can authenticate successfully with the same service connection.

Can you confirm whether:

1. WIF/OIDC service connections are officially supported by Synapse workspace deployment@2?
2. Any additional configuration is required for federated authentication?
3. This is a known limitation or bug in v2.5.0?We're attempting to deploy Synapse artifacts through Azure DevOps using the Synapse workspace deployment@2 task (version 2.5.0) and an Azure Resource Manager service connection configured with Workload Identity Federation (OIDC/Federated Credentials).

   Environment

   • Azure DevOps Pipeline
   • Synapse Workspace Deployment Extension v2.5.0 (latest available version)
   • Azure RM Service Connection using Workload Identity Federation
   • Target workspace: If needed, will provide

   Observed Behavior

   The deployment fails during the Synapse workspace deployment@2 task with:

   Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

   The failure occurs before artifact deployment begins.

   Evidence that Authentication is Working

   The exact same federated service connection successfully authenticates in Azure CLI tasks within the same pipeline: Shell 1 az login --service-principal --federated-token ... Show more lines The pipeline is able to:
   • Authenticate to Azure successfully
   • Retrieve subscription context
   • Execute Synapse CLI commands
   • List Synapse triggers
   • Stop Synapse triggers successfully
   The following Azure CLI task succeeds using the same service connection: Shell 1 az synapse trigger list --workspace-name [will provide if needed] 2 az synapse trigger stop --workspace-name [will provide if needed] --name <trigger> Show more lines This indicates:
   • Federated credential configuration is valid
   • Azure DevOps OIDC token issuance is working
   • Azure RBAC access is working
   • Synapse permissions are present

   Question

   Does Synapse workspace deployment@2 (v2.5.0) support Azure DevOps Workload Identity Federation service connections? The behavior suggests the deployment extension may not be able to consume federated credentials even though Azure CLI tasks in the same pipeline can authenticate successfully with the same service connection. Can you confirm whether:
   1. WIF/OIDC service connections are officially supported by Synapse workspace deployment@2?
   2. Any additional configuration is required for federated authentication?
   3. This is a known limitation or bug in v2.5.0?

Answer 1

Hi
Thank you for providing the detailed information and the troubleshooting you've already performed.

Based on the information shared, the issue does not appear to be related to the Workload Identity Federation (WIF) configuration itself. Since the same Azure Resource Manager service connection successfully authenticates in Azure CLI tasks and is able to execute Synapse CLI commands (such as listing and stopping triggers), it confirms that the federated credential, Azure DevOps OIDC token issuance, and the required Azure permissions are all configured correctly.

The failure occurs specifically within the Synapse workspace deployment@2 (v2.5.0) task while it attempts to acquire an Azure access token before the deployment starts:

Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

Based on the current product documentation and behavior, the Synapse Workspace Deployment Azure DevOps extension does not currently support Azure Resource Manager service connections that use Workload Identity Federation (OIDC). The task continues to rely on the legacy service principal authentication flow for token acquisition, which is why Azure CLI tasks succeed while the deployment task fails.

To answer your questions:

• Does Synapse workspace deployment@2 support Azure DevOps Workload Identity Federation service connections? At this time, no. The deployment task does not officially support WIF/OIDC-based Azure RM service connections.
• Is any additional configuration required? Since the Azure CLI tasks authenticate successfully using the same service connection, no additional WIF configuration is required. Your authentication setup appears to be correct.
• Is this a known limitation? Yes. The observed behavior is consistent with the current limitation of the Synapse Workspace Deployment extension rather than an issue with your service connection or permissions.

As a workaround, you can use AzureCLI@2 or Azure PowerShell tasks with the same WIF-enabled service connection to deploy your Synapse artifacts instead of using the Synapse workspace deployment@2 task.

We hope this helps clarify the behavior. If support for Workload Identity Federation is introduced in a future version of the extension, it will be announced through the Azure DevOps extension release notes and Microsoft documentation.