fix: correct azdo pipeline config federated (OIDC) auth help and stale guard - #9329
Open
vhvb1989 wants to merge 2 commits into
Open
fix: correct azdo pipeline config federated (OIDC) auth help and stale guard#9329vhvb1989 wants to merge 2 commits into
vhvb1989 wants to merge 2 commits into
Conversation
`azd pipeline config --provider azdo` already creates a secretless workload identity federation (OIDC) service connection and federated credential by default (added in #3924). However two things still incorrectly implied Azure DevOps does not support OIDC: - `preConfigureCheck` rejected an explicit `--auth-type federated` with the error "Azure DevOps does not support federated authentication", contradicting the default behavior. Removed the stale guard so explicit federated auth is accepted. - The `--auth-type` flag help said "(Only valid for GitHub provider)". Updated to note both github and azdo default to federated (OIDC). Updates affected unit tests and usage snapshots. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f2c181e7-9da8-49ad-8335-9a317f935d95
|
Azure Pipelines: Successfully started running 1 pipeline(s). 21 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
vhvb1989
marked this pull request as ready for review
July 28, 2026 06:43
vhvb1989
requested review from
JeffreyCA,
RickWinter,
hemarina,
richardpark-msft and
tg-msft
as code owners
July 28, 2026 06:43
🔗 Linked Issue RequiredThanks for the contribution! Please link a GitHub issue to this PR by adding |
6 tasks
|
Azure Pipelines: Successfully started running 1 pipeline(s). 21 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Corrects Azure DevOps federated-auth behavior and aligns CLI help with the existing OIDC default.
Changes:
- Accepts explicit federated authentication for Azure DevOps.
- Updates tests for the corrected behavior.
- Refreshes CLI help snapshots.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
cli/azd/pkg/pipeline/azdo_provider.go |
Removes the stale federated-auth rejection. |
cli/azd/pkg/pipeline/azdo_provider_test.go |
Tests explicit federated auth acceptance. |
cli/azd/pkg/pipeline/pipeline_test.go |
Updates broader provider tests. |
cli/azd/cmd/pipeline.go |
Corrects --auth-type help text. |
cli/azd/cmd/testdata/TestUsage-azd-pipeline-config.snap |
Updates usage snapshot. |
cli/azd/cmd/testdata/TestFigSpec.ts |
Updates completion specification. |
JeffreyCA
approved these changes
Jul 29, 2026
richardpark-msft
left a comment
richardpark-msft
left a comment
Member
There was a problem hiding this comment.
Small thing, but if we could spell out the product types I think it's better.
| { | ||
| name: ['--auth-type'], | ||
| description: 'The authentication type used between the pipeline provider and Azure for deployment (Only valid for GitHub provider). Valid values: federated, client-credentials.', | ||
| description: 'The authentication type used between the pipeline provider and Azure for deployment. Valid values: federated, client-credentials. Both the github and azdo providers default to federated (OIDC) credentials.', |
Member
There was a problem hiding this comment.
Suggested change
| description: 'The authentication type used between the pipeline provider and Azure for deployment. Valid values: federated, client-credentials. Both the github and azdo providers default to federated (OIDC) credentials.', | |
| description: 'The authentication type used between the pipeline provider and Azure for deployment. Valid values: federated, client-credentials. Both the GitHub and Azure DevOps providers default to federated (OIDC) credentials.', |
Member
Author
There was a problem hiding this comment.
Accepted — fixed in 871c70c. Updated the --auth-type help to spell out "GitHub" and "Azure DevOps" and regenerated the snapshots.
| Flags | ||
| -m, --applicationServiceManagementReference string : Service Management Reference. References application or service contact information from a Service or Asset Management database. This value must be a Universally Unique Identifier (UUID). You can set this value globally by running azd config set pipeline.config.applicationServiceManagementReference <UUID>. | ||
| --auth-type string : The authentication type used between the pipeline provider and Azure for deployment (Only valid for GitHub provider). Valid values: federated, client-credentials. | ||
| --auth-type string : The authentication type used between the pipeline provider and Azure for deployment. Valid values: federated, client-credentials. Both the github and azdo providers default to federated (OIDC) credentials. |
Member
There was a problem hiding this comment.
Same feedback here. GitHub casing and expand AzDO
Member
Author
There was a problem hiding this comment.
Accepted — fixed in 871c70c. Updated the --auth-type help to spell out "GitHub" and "Azure DevOps" and regenerated the snapshots.
| "auth-type", | ||
| "", | ||
| "The authentication type used between the pipeline provider and Azure for deployment (Only valid for GitHub provider). Valid values: federated, client-credentials.", | ||
| "The authentication type used between the pipeline provider and Azure for deployment. Valid values: federated, client-credentials. Both the github and azdo providers default to federated (OIDC) credentials.", |
Member
There was a problem hiding this comment.
Same feedback here for wording.
Member
Author
There was a problem hiding this comment.
Accepted — fixed in 871c70c. Updated the --auth-type help to spell out "GitHub" and "Azure DevOps" and regenerated the snapshots.
jongio
approved these changes
Jul 30, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
Reviewed the AzDO federated-auth fix.
Removing the preConfigureCheck guard is correct: credentialOptions and service connection creation already default AzDO to WorkloadIdentityFederation, and pipeline config defaults auth to federated for both providers. Explicit --auth-type federated was the only path incorrectly rejected. Tests and help text updates match that behavior.
@richardpark-msft's wording note (GitHub / Azure DevOps product names in the flag help) is worth taking if you're already touching those strings.
Address review feedback: use proper product-name casing ("GitHub" and
"Azure DevOps") instead of the lowercase provider identifiers in the
--auth-type flag help text. Regenerated usage snapshots.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f2c181e7-9da8-49ad-8335-9a317f935d95
Contributor
There was a problem hiding this comment.
🟢 Ready to approve
The focused behavior and documentation changes are consistent with the existing Azure DevOps federated credential path and are covered by tests.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 0 new
- Review effort level: Medium
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Contributor
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes part of #9319
Context
azd pipeline config --provider azdoalready provisions a secretless (OIDC / workload identity federation) service connection and creates the matching federated credential on the app registration by default. This was implemented in #3924 ("ado with oidc", merged 2024-06-01, fixing #2777) and remains the default code path (endpointScheme := "WorkloadIdentityFederation"inpkg/azdo/service_connection.go, federated credential creation inpkg/pipeline/azdo_provider.go).The gap called out in #9319 is a help-text / docs parity gap, plus one stale in-code guard that contradicted the actual behavior.
Changes
AzdoCiProvider.preConfigureCheck. Passing--auth-type federatedexplicitly was rejected with the error "Azure DevOps does not support federated authentication" — even though federated is exactly the default path. Explicit federated auth is now accepted.--auth-typeflag help. It previously read "(Only valid for GitHub provider)", which is inaccurate. It now notes bothgithubandazdodefault to federated (OIDC) credentials.azdo_provider_test.go,pipeline_test.go) and regenerated usage snapshots (TestUsage-azd-pipeline-config.snap,TestFigSpec.ts).Follow-up (separate repo)
The official Learn docs ("Configure a pipeline using Azure Pipelines") still state OIDC is unsupported for Azure Pipelinesand is being addressed in a separate docs PR.
Testing
go build ./...go test ./pkg/pipeline/UPDATE_SNAPSHOTS=true go test ./cmd -run 'TestFigSpec|TestUsage'