There is an Azure Function in Y tenant that creates a Pull Request in ADO which is in X tenant.
Currently this ADO authentication is done with my PAT.
Below are the issues with authentication with PAT-
- All the automated PRs are created under my name.
- Need to manually rotate the PAT before expiry.
- Using PAT is not recommended any more as there are more secured way of authentications like Service Principles and Managed Identities.
I tried the authentication with managed identities, and I was able to go through but faced a challenge when deploying the code in Y tenant. Since the managed identity needs to be added in the ADO but ADO will add only those resources which are in X tenant. So, there is a tenant constraint.
Another approach that I took was to create a service account and use its PAT.
Then to automatically rotate the pat I implemented a logic which works fine but I don’t think it is recommended.
Could someone suggest the best approach to achieve this?
References:
- https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/manage-personal-access-tokens-via-api?view=azure-devops#authenticate-with-microsoft-entra-tokens
- https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity?view=azure-devops#2-add-and-manage-service-principals-in-an-azure-devops-organization
- https://blogs.blackmarble.co.uk/rfennell/a-more-secure-alternative-to-pat-tokens-for-azure-devops/
Akash Anup is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.