I was curious about how to set up Azure DevOps to utilize Terraform for deploying Azure resources with workload identity federation instead of relying on a service principal with secrets. In this blog post, I will demonstrate how I set up this configuration.

To learn more about workload identity federation read the docs:
Workload identity federation - Microsoft Entra | Microsoft Learn

Prerequisites

• Azure DevOps Org
• “Customer Azure Tenant” with Subscription
• “Backend Azure Tenant” with Subscription (can be in the same tenant - in our example we use different tenants)
• Azure Powershell Module

Overview - Setup Steps

1. Create a storage account that will store the Terraform state file
2. Create a managed identity which has contributor permissions on this storage account
3. If not already the case, install the Terraform extension for your Azure DevOps Org
4. Create a new Azure DevOps Project
5. Create a service connection to the “backend tenant” using workload identity federation with your previously created managed identity
6. Create a managed identity in the customer tenant where you finally want to deploy Azure Resources using Terraform, with Contributor permission on the Subscription
7. Create a service connection to the customer tenant using workload identity federation with your previously created managed identity
8. Create a repository with basic Terraform files
9. Create an Azure DevOps Pipeline

MindMap for the Book
Steal Like an Artist: 10 Things Nobody Told You About Being Creative

Note: My Microsoft Cybersecurity Architect MindMap covers already a lot of topics mentioned here: SC-100 MindMap Collection

This MindMap is based on the MS Learning path: SC-300

Certificates MindMap:

• SSL certificates - what? why?
• How do certificates work?
• Types of certificates
• How HTTPS encryption works
• CERTIFICATION AUTHORITIES (CA)
• ..

Download the mind map as PNG SSL/TLS Certificates - Mindmap:

Note: My Microsoft Cybersecurity Architect MindMap covers already a lot of topics mentioned here: SC-100 MindMap Collection

This MindMap is based on the MS Learning path: AZ-500

I did a little Microsoft Entra Private Access Test setup.
My goal was to test access to some private Resources hosted on Azure Virtual Machines with Microsoft Entra Private Access instead of VPN.

Overview

The test setup is illustrated below:

I have one Virtual Machine (VM) with a Windows File Share that I wish to access from my endpoint and I also want to be able to access this VM via RDP.
Additionaly in another Spoke VNET I have a simple Web Server which I also would like to access via Private Access.