Client secrets have traditionally been the go-to method for deploying Power Platform solutions from Azure DevOps, utilizing app registrations from the Azure platform. However, my personal experience has shown that this approach can be problematic, especially when you are not an application admin. It often involves wasting time figuring out why deployments have failed due to expired or missing client secrets. Even when reaching out to someone with application admin rights, they might generate a new client secret but forget to update the service connections for each service connection within Azure DevOps or the application admin does not have access requiring to reach out to someone else who have access, causing further disruptions.

Introduction Thanks to Kinga Kazala for her timely article Deploy SPFx app using pipeline’s Workload Identity federation, which showcases how to use Workload Identity Federation to alleviate the need for using Entra app secrets or certificates. This method simplifies the setup process, especially when there’s reliance on a single person who might be unavailable. We initially set up the SPFx pipeline for the Test environment using certificates with CLI for M365.