azureazure-devops

Azure Active Directory App service Principal create new client secret

I have an Azure Active Directory App service Principal's client secret will expired soon.

Can I just create a new client secret without rotating the existing one and waiting for the old one to expire? Will it automatically use the new client secret?

I'm using Azure Active Directory App service Principal for Azure DevOps Docker service connection. It didn't require me to enter client secret. Approach: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity?view=azure-devops#create-an-application-service-principal

Docker service connection pic

Solution

  • Will it automatically use the new client secret

    No, it will not use the new secret automatically.

    To resolve this issue, you can try the following workarounds:

    1. Delete the expired secret and create a new one. Make some changes to your service connection, for example, add or edit the Description filed. Then click the Save button. It may take some time to refresh the token.

      enter image description here

    2. Create a new Container Registry service connection and use workload identity federation as the authentication type.

      Workload identity federation enables you to use short-lived tokens for authenticating to Azure and remove the limit of the service principle's secret. So that you don't need to create a new service connection when the secret expires again.

      enter image description here

      See more info about workload identity federation from Workload identity federation and September 11th, 2023 Introduction to Azure DevOps Workload identity federation.