Authentication Azure App Credentials with Certificate (Sign JWT with Private Key)

Description

Same as Application Credentials but uses a client certificate instead of a secret. [API reference]

Instructions

Step 1: Register the App in Microsoft Entra ID (AAD)

1. Go to the Azure Portal > Microsoft Entra ID > App registrations and click New registration:
2. Name it (e.g., ZS-AzureDevOps-CertAuth).
3. Set Supported account types to "Accounts in this organizational directory only" (Single Tenant):
4. Leave Redirect URI blank (it's not used for Client Credentials flows).
5. Click Register.

Step 2: Upload Client Certificate

1. In your new app, go to Certificates & secrets.
2. Click the Certificates tab, then click Upload certificate.
3. Upload your public key certificate (.cer, .pem, or .crt). Keep the private key secure on your system.
4. Copy the Thumbprint for your configuration:

Step 3: Set Permissions and Admin Consent

1. Go to API permissions > Add a permission.
2. Select Azure DevOps and click Delegated permissions.
3. Select the required scopes (e.g., vso.project, vso.work_full).
4. Crucial: Click Grant admin consent for [Your Tenant]. Without this, the background service cannot acquire a token.

Step 4: Map the App to Azure DevOps Organization

1. Copy your Application (client) ID from the App Overview page.
2. Go to your Azure DevOps Organization Settings > Users.
3. Click Add users and paste the Application (client) ID in the search box to find the App.
4. Assign an Access level (usually Basic) and add it to the relevant Projects.

Step 5: Connection Settings

In your SSIS package or ODBC data source, use the following in the Client Certificate configuration:

• In the Token URL field, paste the OAuth token endpoint (v2) URL from the Azure Portal 'Endpoints' tab.
• In the Client ID field, paste the Application (client) ID.
• Configure your Certificate Path or Thumbprint in the Client Certificate tab of the connector.
• In the Scope field, use: https://app.vssps.visualstudio.com/.default

Step 6: Finalize Connection

1. Press Generate Token. The connector will sign the request using your certificate to fetch a token.
2. Click Test Connection to confirm the setup.
3. Done! Your certificate-based connection is ready!

Parameters