Your application builds successfully in Azure DevOps, but deployment stops when the pipeline tries to reach Azure. You can see the subscription in the Azure portal, yet the pipeline reports an authorization failure. Signing in as a developer did not give the deployment job the same access.
Learning how to connect Azure DevOps to Azure subscription starts with separating your personal account from the identity that runs automation. For deployments, the normal connection is an Azure Resource Manager service connection—not a password pasted into YAML.
This guide explains how to create that connection with workload identity federation, scope its permissions, authorize a pipeline, and verify access without deploying resources.
Understand What You Are Connecting
“Connect Azure DevOps to Azure” can mean two different tasks:
| Goal | Where to configure it |
|---|---|
| Let pipelines deploy or manage Azure resources | Project settings > Service connections |
| Charge Azure DevOps purchases to an Azure subscription | Organization settings > Billing |
Billing setup does not grant deployment access. A service connection does not automatically change the organization’s billing subscription.
This tutorial focuses on pipeline access and covers billing separately near the end.
Azure Resource Manager is Azure’s management layer. An Azure Resource Manager service connection lets supported pipeline tasks obtain credentials for that layer.
An Azure subscription is a billing and governance boundary. A resource group is a logical container inside it. Scoping access to one resource group can limit the impact of a deployment mistake.
For background, see what an Azure subscription is and the Azure DevOps beginner tutorial.
Pro Tip: I recommend naming the goal before choosing a menu. “Deploy to Azure” and “pay for Azure DevOps” are separate setup tasks.
Check Permissions and Choose the Target Scope
Before opening the connection wizard, identify:
- The Azure DevOps project.
- The target Microsoft Entra tenant and Azure subscription.
- The development resource group.
- The operations the pipeline must perform.
- Who will own the connection.
Microsoft Entra ID is the identity service that authenticates users and applications. Azure RBAC—role-based access control—determines what an authenticated identity may do.
Three permission areas matter:
| Area | Required capability |
|---|---|
| Azure DevOps | Create or administer service connections |
| Microsoft Entra ID | Create or manage the selected identity and federated credential |
| Azure | Assign the identity appropriate access to the target scope |
The automatic app-registration workflow has prerequisites that include subscription Owner access. That is a setup requirement for the person performing the workflow, not a recommendation to make the pipeline ident