Feature request: Add support for Azure DevOps service connections backed by a managed identity

[mpwaldhorst]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

In the recent update announcement from Azure DevOps the introduction of Azure DevOps service connections backed by an Entra workload Identity was announced:

• https://learn.microsoft.com/en-us/azure/devops/release-notes/2026/sprint-275-update#access-azure-devops-with-microsoft-entra-authentication

From what I could find the creation of a service endpoint/service connection for this type is not available in the provider.

When trying to use an identity that is scoped to azurerm the pipeline fails with the following error:

The pipeline is not valid. Job <job_name>: Step <step_name> input azureDevOpsServiceConnection expects a service connection of type WorkloadIdentityUser but the provided service connection <service_connection_name> is of type azurerm.

To support this feature the terraform provider needs to be updated to create these type of service connections/endpoints.

Note: The current service endpoint of type azuredevops is deprecated

New or Affected Resource(s)

• azuredevops_servicendpoint_azuredevops

Potential Terraform Configuration

I tried gobbling together a possible configuration based on azuredevops_serviceendpoint_azuredevops and azuredevops_serviceendpoint_azurerm.
However, this can likely be made much nice by someone with more context:

resource "azuredevops_serviceendpoint_azuredevops" "example" {
  project_id            = azuredevops_project.example.id
  service_endpoint_name = "Example Azure DevOps"
  description           = "Managed by Terraform"

  org_url               = "https://dev.azure.com/testorganization"
  spn_tenantid    = "<entra_tenant_id>"
  
  credentials {
    serviceprincipalid = "<service_principal_id>"
  }
}

References

• Azure DevOps Feature announcement (Sprint update 275)
• azuredevops_serviceendpoint_azuredevops
• azuredevops_serviceendpoint_azurerm