How to create Azure DevOps Service Connection scoped to multiple Resource Groups

Question

I have a project whose resources spanned across 3 resource groups. I want to create a Service connection scoped to all those resource groups so that i can manage access at one place through that service connection. Currently i created 3 service connections scoped to each resource group. I don't want to scope it to subscription since there are other teams handling projects in that subscription. It will give me maintenance and audit issues in the future.

If i create a service principal and assign it to 3 resource groups and then attach this service principal to service connection then would it be good design?

Is there any better way to achieve this ?

Awestricken

Hi ,Venky Is bbaywet's answer helpful to your issue? – Donahue

Answer 1

You don't have to create the service principal manually. You can use the interface to create the service principal, grant permissions on the first resource group and configure the connection automatically for you.
Then once it's done, look at the service connection to identify the service principal in use, and give it permissions on the other resource groups.
And yes it is a good design, the only drawback compared to 3 service principals is that you have less granularity over who in Azure DevOps has access to each of these 3 resource groups via permissions on the service service connection(s) (as you only have one and not 3)

Hearth

Thanks. Do you know anyway to automate all this process through powershell/cli/ARM? – Awestricken

I suggest you ask a separate question for this but you could use powershell to create app service principals learn.microsoft.com/en-us/powershell/azure/azurerm/… and assign it to the resource group. azure.microsoft.com/en-us/resources/templates/… Not sure how to automate the service connection part on ADO though – Hearth

The only possible caution here is that if you Edit the connection via the Azure DevOps interface it may create a new ServicePrincipal and/or remove your extended permissions. – Prostitution

Answer 2

When you create a new Service Connection in the Azure DevOps, it will create an Azure AD app registration, and a new service principal will be created for the Resource Group you choose.

So you can just go to any resource group and then add a principal using the Access control (IAM). Select the Add role assignment option and then select the role as a contributor in the role grid, press next. From the next screen, select user, group, or service principal as the option for Assign access to. Click on the + Select members, search for our AD Registered app name, the display name and then select the same from the result, click on the select button. Finally, click the Review + assign button.

I have written a detailed article to explain the steps, you can read that here.

Louvar