When working in Azure DevOps, we often need to connect to external services like Azure, GitHub, Docker Hub, or even AWS.
That’s where Service Connections come in — they act like a bridge between your DevOps project and the outside world.
🚀 What is a Service Connection?
A Service Connection in Azure DevOps is a secure link that allows our pipelines to access external resources. Think of it like saving your login credentials in a safe, so that our CI/CD pipelines can automatically deploy, build, or test without asking for credentials each time.
For example:
- When deploying code to Azure App Service, we need a Service Connection to authenticate with Azure.
- When pulling a container from Docker Hub, a Service Connection stores our Docker credentials securely.
🔐 Why Do We Need It?
Without a service connection, our pipeline wouldn’t know how to connect to our cloud or external system securely.
Here’s why it’s essential:
- ✅ Security: Credentials are stored securely in Azure DevOps, not in your pipeline code.
- 🔁 Automation: Pipelines can deploy automatically without manual logins.
- 👥 Access Control: You can control who can use or manage each connection.
- 🧠 Consistency: Keeps configuration consistent across teams and environments.
🛠️ Common Types of Service Connections
Here are some popular ones you’ll use often:
| Type | Description |
|---|---|
| Azure Resource Manager (ARM) | Connects to Azure subscriptions to deploy resources. |
| GitHub / Bitbucket | Connects to repositories for pulling code. |
| Docker Registry | Connects to Docker Hub or Azure Container Registry for container images. |
| Service Principal (Manual) | Connects using a custom app registration in Azure AD. |
| Generic Service Connection | Connects to APIs or services using a username and token. |
⚙️ How to Create a Service Connection (Step-by-Step)
Let’s walk through creating a Service Connection in Azure DevOps to connect with Azure using a service connection with secret. Latest recomendation is to use
- Go to your Azure DevOps Project.
- Navigate to Project Settings → Service Connections.
- Click New Service Connection.
- For Service or Connection Type, choose Azure Resource Manager, then click Next.
- For Identity Type, select App registration (automatic) — this is the currently recommended option.
- For Credential, select Secret. (The new recommended option is Workload Identity Federation, which offers more secure authentication.)
- Under Scope Level, choose Subscription — this is the most common option.
- Pick your Subscription, and optionally limit access by selecting a specific Resource Group.
- Enter a Service Connection Name — for example,
Cocan-infra-serv-connection. - Do not check Grant access permission to all pipelines if you don’t want all pipelines to automatically use this connection.
- Click Save.
We can verify the new service connection from the App registrations page in the connected Entra ID.
Note 1: When we create a Service Connection, Azure DevOps automatically creates a Service Principal in Entra ID (App Registration).
If yur Azure DevOps account has Owner or User Access Administrator permissions on the subscription, it will also assign the Contributor role automatically. Otherwise, ourself or an admin may need to manually assign a suitable role (like Contributor) under Azure Portal → Subscription → Access control (IAM).
Note 2: In this example, we used Azure Resource Manager, but Azure DevOps supports many other service or connection types, such as: Azure Repos / Team Foundation Server, Azure Resource Manager, Azure Service Bus, Bitbucket Cloud, Cargo, Chef, Docker Host, Docker Registry, Generic, GitHub, GitHub Enterprise Server, Incoming WebHook, Jenkins, Jira, Kubernetes, Maven, npm, NuGet, Other Git, Python package download, Python package upload, Service Fabric, SSH, Subversion, and Visual Studio App Center. Each connection type allows Azure DevOps to securely integrate with different tools and platforms — from code repositories and registries to automation, testing, and cloud services.
🧪 Using the Service Connection in Pipelines
Once created, you can reference it in your pipeline YAML file like this:
trigger:
- main
pool:
vmImage: 'ubuntu-latest'
steps:
- task: AzureWebApp@1
inputs:
azureSubscription: 'Azure-Dev-Connection'
appName: 'mywebapp'
package: '$(System.DefaultWorkingDirectory)/drop/*.zip'
Here, azureSubscription refers to the Service Connection name we created earlier. We will see this hands on later when we explore terraform.
🧭 Tips and Best Practices
- 🔑 Use service principals with minimal permissions.
- 🚫 Don’t hardcode credentials in pipelines.
- 🧩 Use different service connections for dev, test, and production.
- 🕵️♂️ Regularly review and rotate credentials.
- 👥 Limit who can edit service connections using Role-Based Access Control (RBAC).
🧠 In Summary
A Service Connection is like a passport that lets Azure DevOps securely interact with other platforms — without you needing to manually log in every time.
It’s one of the most important building blocks of a secure and automated DevOps workflow.