You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. You are designing an Azure DevOps solution to deploy…

The Microsoft Cloud Adoption Framework's DevSecOps best practices strongly advocate for eliminating secrets from CI/CD pipelines to reduce the attack surface. Managed identities provide an automatically managed identity in Azure Active Directory (Azure AD) for services like Azure DevOps. When used with a service connection configured for Workload Identity Federation, it allows the pipeline to authenticate to Azure resources without storing any passwords, client secrets, or certificates in Azure DevOps. This secret-less approach is the most secure and recommended method for service-to-service authentication, directly aligning with modern DevSecOps principles.

A. Using an Azure AD user account with a password, even in Key Vault, introduces a manageable secret that must be rotated and can be compromised. Best practice is to eliminate secrets entirely.

B. Group managed service accounts (gMSAs) are an on-premises Active Directory Domain Services (AD DS) identity type and are not designed for authenticating cloud services like Azure DevOps to Azure.

C. Azure AD Privileged Identity Management (PIM) is designed for just-in-time (JIT) access for human users, often requiring interactive approval or MFA, making it unsuitable for automated, non-interactive CI/CD pipelines.

---

1. Microsoft Cloud Adoption Framework

DevSecOps controls

"Secure the pipeline" section: "Use service principals that have the minimum permissions required. Rotate secrets and certificates regularly. Better yet

use managed identities to remove the need for secrets and certificates." This directly recommends managed identities over secret-based methods.

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#secure-the-pipeline

2. Azure DevOps Documentation

"Connect to Microsoft Azure by using an ARM service connection": This document describes the "Workload Identity federation" authentication method for service connections

stating

"Workload identity federation allows you to create a secret-free service connection in Azure Pipelines to Azure." This is the modern implementation that leverages managed identities or other workload identities.

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops#create-an-azure-resource-manager-service-connection-using-workload-identity-federation

3. Azure Active Directory Documentation

"What are managed identities for Azure resources?": "Managed identities for Azure resources is a feature of Azure Active Directory... You can use the identity to authenticate to any service that supports Azure AD authentication

without having any credentials in your code." This explains the fundamental benefit and purpose of managed identities

which is to eliminate credentials.

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview