Azure DevOps Is Killing an Old Authentication Way

Microsoft is retiring the Azure DevOps Issuer in Workload Identity Federation — the way DevOps pipelines prove their identity when talking to Azure services. The retirement is part of a broader push toward a newer federation model. Teams that still rely on the old issuer will need to migrate their pipelines before the cutoff.

Workload Identity Federation lets services authenticate without long-lived credentials like passwords or service principals. Instead, they use tokens that expire — cleaner, more secure, and easier to manage at scale. If your pipelines talk to Azure APIs, that's the plumbing behind the scenes.

Why this matters for us: Brown and Black engineers running pipelines in Azure need to know when Microsoft changes the plumbing — so they don't wake up to broken deployments.