Configure Azure Service Principal for Deployments - Andrei15193/HintKeep GitHub Wiki

Azure uses service principals to authorize access to 3rd party applications to their platform, this is a secure way for authenticating on Azure and perform background or automated tasks such as deployments and resource creation.

  1. From the Azure Portal, navigate to Entra ID.
    azure portal

  2. Under Manage, select App Registrations and click on New registration.
    manage app registrations

  3. Fill the form, generally, there should be a Service Principal (App Registration) for each environment or group of environments when allowing access at the subscription level for extra security and traceability. Click on register.
    add app registration

  4. Once created, under Manage navigate to Certificates & Secrets, select Federated credentials and click on Add credential.
    manage federated credentials

  5. GitHub is a recognized 3rd party by Azure (both owned by Microsoft) and is allowed to retrieve access tokens and perform actions on behalf of the App Registration inside Azure limited to the role assignments. The environment deployment flow is configured, multiple credentials can be configured for the same App Registration allowing it to be reused across multiple environments.

    Once the form has been filled with all required fields, click Add.
    add federated credential

  6. Go to the Overview of the App Registration and copy the Display name. Copy the Application ID and Tenant ID as well, this will be configured in GitHub as well.
    copy app registration display name

  7. Go to Subscriptions, select the one where deployments will be made, navigate to Access Control (IAM) and click on Add then Add role assignment.
    add role assignment

  8. Navigate to Privileged roles, then select Owner and click Next. The service principal needs to be able to both create resources (including resource groups) as well as assign roles to the system assigned managed identity.
    select owner role

  9. Click on Select members, then search for the App Registration display name, select it and then click on Select.
    select app registration

  10. The Owner role is a highly privileged role which can perform role assignments to any other object (user, groups, itself), the roles it is allowed to assign should be limited to the ones that are required by the managed identity. Click on Select roles and principals.
    select role assignment conditions

    Under Constrain roles click on Configure, filter the roles by "storage data contributor" and select the ones related to the Storage Account, any other roles that the managed identity requires should be selected as well.
    select constrained roles

  11. Once configured, click on the Save buttons. The service principal will not be able to assign other roles than the specified ones.
    confirm constrained roles

  12. Click on Review + assign. With that the Azure manual configuration is complete, everything else is handled through Azure Bicep (ARM) deployments.
    review and create role assignment

This is all the manual configuration required on Azure, afterwards the creation of resources and deployments are performed automatically through the deployment pipeline.