ADO deploy function app with self hosted agent

Question

Has anyone deployed a function apps with a self-hosted agent? looks like the ADO tasks all require a service connection.

- task: AzureFunctionApp@2
 inputs:
 connectedServiceNameARM: # string. Alias: azureSubscription. **Required**

We have a hub-spoke architecture with a ton of security and have the agents deployed to each hub, that's how we currently deploy.

Also can't create a service connection to our government subs.

Answer 1

Whether you're using a self-hosted agent or Microsoft provided cloud agent, you'll need credentials in the Azure Subscription. You're going to need a service principal of some kind.

Service Connections are the preferred and fundamental concept for securely abstracting away endpoint and credential details from the pipeline authors. The vast majority of tasks in the azure devops marketplace are engineered with this concept and require a service connection. Service Connections also offer additional levels of security in that each pipeline must be authorized by the service connection owner, and approvals and checks can be applied to regulate their use with approvals, business hours, etc. Service Connections also support workload identity federation (oidc) so there are no application secrets that need to be recycled.

Assuming your hub-and-spoke model uses separate subscriptions for the spokes and a common AD tenant in the hub, you can either:

• create a single identity (service principal) and grant it the necessary credentials to each subscription. Create one service connection that targets the Management Group (instead of the subscription); or
• create an identity per subscription with the appropriate credentials. Create a service-connection per identity.

Azure DevOps supports service connections that target Azure Government.

If you don't have the authority to create the service principal, the service principals can be created by an admin and then manually configured within Azure DevOps.

• Flightdeck73: that's exactly what we have, one tenant and subs for each client with their own mi's, for their hub and each spoke(s). further investigation, looks like our ADO is setup to connect to our non gov azure, and its not letting me add the gov. so when i try to create a service connection it is only listing our non azure sub/resources
• bryanbcook: understood. your EntraID for your ADO environment is not the same tenant that is associated with your Subscriptions. When creating a service principal via the service connection UI the "(automatic)" option requires the same tenant. You can create the service principals manually in Entra and then use the "(manual)" option in the UI. You'll need to provide the subscription id and other details when setting it up.