Create an Azure Resource Manager service connection in Azure DevOps using workload identity federation instead of a client secret

Steps

1. In Azure DevOps, create a new Azure Resource Manager service connection and choose the Workload Identity Federation authentication method.
2. Pick 'automatic' for Azure DevOps to provision and federate an app registration/managed identity for you, or 'manual' if you need control over the identity's name and permissions, or want to reuse an existing identity.
3. For manual setup, copy the federated credential values Azure DevOps shows — issuer, subject identifier in the form sc://<organization>/<project>/<service-connection-name>, and audience api://AzureADTokenExchange — and add them as a federated credential on the identity in Microsoft Entra.
4. Grant the identity the Azure RBAC role(s) needed on the target subscription or resource group.
5. Reference the service connection by name in an AzureCLI@2 (or similar Azure Resource Manager-based) pipeline task; Azure Pipelines exchanges its own OIDC token for a short-lived Azure access token at run time with no stored secret.