Creating Azure DevOps Workload Identity Federation with Az CLI/Az PS

does anyone know how to create an Azure DevOps "Azure Resource Manager/Workload Identity federation with OpenID Connect" Service Endpoint automated using Az CLI or Az PS terminals? Failing that even calling the Azure DevOPs REST API will do.

Highlighted is what I'm looking to create:

From investigation, at best they allow you to create only regular Service Principal endpoints? From what I can these WIF ARM Service Endpoints can be created only using the AzDO front end portal, and even Terraform, but neither fits my use. It seems crazy that MS have exposed WIF service endpoints to a third party solution (Terraform), but not their own internal cmdlet modules!

Any advice will be greatly appreciated.

As mentioned in this MS Doc, you must first define the configuration file to create a service endpoint of Workload Identity Federation type via Azure CLI.

devops.json:

{
    "data": {
      "subscriptionId": "subId",
      "subscriptionName": "subName",
      "environment": "AzureCloud",
      "scopeLevel": "Subscription"
    },
    "name": "WorkFederatedSE",
    "type": "azurerm",
    "url": "https://management.azure.com/",
    "authorization": {
      "scheme": "WorkloadIdentityFederation",
      "parameters": {
        "tenantid": "tenantId",
        "serviceprincipalid": "appId"
      }
    },
    "isShared": false,
    "isReady": true,
    "serviceEndpointProjectReferences": [
      {
        "projectReference": {
          "id": "projectId",
          "name": "projName"
        },
        "name": "WorkFederatedSE"
      }
    ]
  }

In my case, I uploaded this .json file in Azure Cloud Shell and ran below CLI command to create service connection after connecting with az login:

az devops service-endpoint create --service-endpoint-configuration ./devops.json --org https://dev.azure.com/orgName/ --project projName

Response:

When I checked the same in Azure DevOps portal, new service connection created successfully like this:

You can check that service connection properties by clicking Edit button that has "Workload Identity federation with OpenID Connect" type as below:

To create the same using Azure DevOps REST API, make use of below request:

POST https://dev.azure.com/orgname/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4

{
    "data": {
      "subscriptionId": "subId",
      "subscriptionName": "subName",
      "environment": "AzureCloud",
      "scopeLevel": "Subscription"
    },
    "name": "WorkFederatedSE",
    "type": "azurerm",
    "url": "https://management.azure.com/",
    "authorization": {
      "scheme": "WorkloadIdentityFederation",
      "parameters": {
        "tenantid": "tenantId",
        "serviceprincipalid": "appId"
      }
    },
    "isShared": false,
    "isReady": true,
    "serviceEndpointProjectReferences": [
      {
        "projectReference": {
          "id": "projectId",
          "name": "projName"
        },
        "name": "WorkFederatedSE"
      }
    ]
  }

Response:

For service connection of "Azure Resource Manager using Workload Identity federation with OpenID Connect (automatic)" type, add "creationMode": "Automatic", in data section and remove serviceprincipalid like this:

POST https://dev.azure.com/orgname/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4

{
    "data": {
      "subscriptionId": "subId",
      "subscriptionName": "subName",
      "creationMode": "Automatic", //Add this
      "environment": "AzureCloud",
      "scopeLevel": "Subscription"
    },
    "name": "WorkFederatedSEAut",
    "type": "azurerm",
    "url": "https://management.azure.com/",
    "authorization": {
      "scheme": "WorkloadIdentityFederation",
      "parameters": {
        "tenantid": "tenantId"
      }
    },
    "isShared": false,
    "isReady": true,
    "serviceEndpointProjectReferences": [
      {
        "projectReference": {
          "id": "projectId",
          "name": "projName"
        },
        "name": "WorkFederatedSEAut"
      }
    ]
  }

Response:

When I checked in DevOps Portal, new service connection of Automatic type created successfully:

Reference:

Endpoints - Create - REST API (Azure DevOps Service Endpoint) | Microsoft