Skip to content

Commit 67df643

Browse files
authored
Enhance CI/CD documentation for Workload Identity Federation
While the existing note accurately states that WIF is not supported, it does not help enterprise users adhere to Microsoft’s security baseline that favors federated auth over stored secrets. Adding explicit references to the official WIF docs and CLI workaround aligns this page with Microsoft’s own DevOps authentication guidelines and prevents customers from falling back to less secure credentials. Secondly, when we say something is not supported - we also need to mention the workaround. I am a Microsoft FTE ( Satishbal is my alias)
1 parent 5f7fe0e commit 67df643

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

articles/synapse-analytics/cicd/continuous-integration-delivery.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,14 @@ You can choose the operation types based on the use case. Following part is an e
253253
> In CI/CD scenarios, the integration runtime type in different environments must be the same. For example, if you have a self-hosted integration runtime in the development environment, the same integration runtime must be self-hosted in other environments, such as in test and production. Similarly, if you're sharing integration runtimes across multiple stages, the integration runtimes must be linked and self-hosted in all environments, such as in development, test, and production.
254254
>
255255
> Currently, the DevOps Service Connection with **Workload Identity Federation (WIF)** is not supported in Synapse Workspace deployment extension. Switch to secret mode to make the connection successful.
256+
> For secure, secret-less alternatives that fully support Workload Identity Federation (WIF),
257+
> use the [AzureCLI@2](https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/azure-cli-v2)
258+
> or [PowerShell](https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/powershell-v2)
259+
> pipeline tasks with a federated service connection, as described in
260+
> [Connect to Azure using Workload Identity Federation](https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure?view=azure-devops#workload-identity-federation).
261+
>
262+
> These tasks support secret-less authentication and can execute Synapse deployment commands
263+
> (`az synapse pipeline create`, `az synapse artifact publish`) while maintaining the same deployment flow.
256264

257265
### Create a release for deployment
258266

0 commit comments

Comments
 (0)