3.1.6. Pipeline Maintenance and Optimization
3.1.6.X. Secretless Pipeline Authentication
Workload identity federation eliminates stored credentials for pipeline-to-Azure authentication. Instead of a service principal client secret (which must be stored, rotated, and can be leaked), the pipeline's runtime OIDC token is exchanged directly with Azure AD.
How it works: Azure DevOps or GitHub Actions issues an identity token for each pipeline run. Azure AD validates this token against a configured federated credential (trusted issuer + subject). If valid, Azure AD issues an access token — no secret ever stored or transmitted.
Managed identities provide the same secretless benefit for self-hosted agents running on Azure VMs. The VM's system-assigned identity authenticates to Azure resources without any credentials in the pipeline configuration.
