Migrate dn-bot-all-orgs-build-rw-code-rw from PAT to Entra auth#16785
Merged
premun merged 4 commits intoMay 12, 2026
Merged
Conversation
…0141) Replace PAT-based AzDO API authentication in the publishing pipeline with Entra-based auth using the existing maestro-build-promotion WIF service connection. Changes: - CreateAzdoClient(): Fall back to DefaultIdentityTokenCredential (bearer token for AzDO resource 499b84ac-...) when no PAT is provided - HasEntraCredentialsAvailable(): New validation helper checking for AzurePipelinesCredential, WorkloadIdentityCredential, or MI environment - publish.yml: Remove AzdoApiToken PAT reference, add addSpnToEnvironment - publish-logs.yml: Remove PAT from binlog redaction list - product-builds-engkeyvault.yaml: Delete PAT from Key Vault manifest Post-merge: Un-map dn-bot-all-orgs-build-rw-code-rw from VGs 20 (Publish-Build-Assets) and 110 (DotNet-Source-Build-All-Orgs-Source-Access) before the secret-manager deletes the Key Vault secret.
The unqualified Azure.Core.TokenRequestContext was being resolved as Microsoft.Azure.Core.TokenRequestContext due to the Microsoft namespace being in scope, causing CS0234. Using global::Azure.Core disambiguates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
premun
approved these changes
May 12, 2026
oleksandr-didyk
approved these changes
May 12, 2026
pavel-purma
approved these changes
May 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates the dn-bot-all-orgs-build-rw-code-rw PAT from Basic auth to Entra-based authentication using the existing maestro-build-promotion WIF service connection in the V3 publishing pipeline.
Work Item: https://dev.azure.com/dnceng/internal/_workitems/edit/10141
Changes
C# (PublishArtifactsInManifestBase.cs)
DefaultIdentityTokenCredentialwith bearer token for AzDO resource (499b84ac-1321-427f-aa17-267ca6975798/.default). SupportsAzurePipelinesCredential(from AzureCLI@2 withaddSpnToEnvironment:true),ManagedIdentityCredential,WorkloadIdentityCredential, andAzureCliCredential.AzdoApiTokenwhen Entra credentials are also unavailable.YAML (eng/publishing/v3/publish.yml)
addSpnToEnvironment: trueto the 'Publish packages, blobs and symbols'AzureCLI@2task (azureSubscription: maestro-build-promotion)/p:AzdoApiToken=''from MSBuild argumentsYAML (eng/common/core-templates/steps/publish-logs.yml)
''from binlog secret redaction listSecret Manifest (.vault-config/product-builds-engkeyvault.yaml)
dn-bot-all-orgs-build-rw-code-rwentryPost-merge steps
dn-bot-all-orgs-build-rw-code-rwfrom VG 20 (Publish-Build-Assets) and VG 110 (DotNet-Source-Build-All-Orgs-Source-Access) before secret-manager runsmaestro-build-promotion-miis already enrolled indncengorg withReadersgroup access (verified)Identity details
maestro-build-promotion-mi(AppId:6e870007-e236-4eb1-8734-8bf8cd54c748)maestro-build-promotion(ID:df3b9892-c5c9-4d64-8b72-edd72e049305, type:azurerm, auth:WorkloadIdentityFederation)dnceng/internalReaders group