I am writing an application that needs to pull source code from Azure DevOps Git repo. I couldn't find any option to create a service principal like in Azure. I could create a PAT in my account but then all access will be marked as done by me. As far as I understand Build Agents do exactly this. Is there any option to leverage this functionality for my purpose?
1 Answers
Service principal just work as an impersonation for user in Azure AD.
Using this you can perform any type of management task against Azure using REST APIs. This way you avoid need of providing credentials in pop up and hence help to automate things in Azure using REST APIs.
The closest thing in Azure DevOps should be personal access token.
Personal access tokens (PATs) give you access to Azure DevOps and Team Foundation Server (TFS), without using your username and password directly. These tokens have an expiration date from when they're created. You can restrict the scope of the data they can access.
I could create a PAT in my account but then all access will be marked as done by me.Instead of your personal account, you could create a fake AAD user then add it to your Azure DevOps Service.
Use that account to create a Personal Access Token. Similar to Build Service account to pull source code. This should be a better way to track everything.
Related