Adding an Azure Resource Manager Service Connection in AzureDevOps

Add an Azure Resource Manager service connection.md

Taken from: https://blogs.msdn.microsoft.com/mihansen/2018/03/31/granular-vststfs-deployment-privileges-using-service-principals/

AzureDevOpsAR is simply the name of the app registration AzureDevOps will be associated with, don't like the name? Simply change the references below.

1. Create an App Registration to act as a Service Principal:
   1. Log in to portal.azure.com
   2. Azure Active Directory => App Registrations => New Application Registration
   3. Name: AzureDevOpsAR, Type: Web app/API, Url: http://azuredevopsar (Url isn't important as it won't be used)
   4. Copy the Application ID as this will be the Service principal client ID
   5. Settings => Keys => Add
   6. Name: 'AzureDevOps', Expiry: Never => Save (Name isn't important as long as it is unique)
   7. Copy the Key as this will be the Service principal key
2. Grant the App Registration appropriate permissions to the Resource Group or Subscription:
   1. Navigate to the appropriate Item
   2. Access control (IAM)
   3. Add => 'AzureDevOpsAR' => Contributor
3. Complete the dialog

• Service Principal Authentication
• Connection Name: => Reference only, though Subscription Name + App Registration scope is a good start
• Environment: Azure Cloud
• Scope level: Subscription
• Subscription ID: => portal.azure.com => search => 'subscriptions' => copy the ID
• Subscription Name: => as above => copy the name
• Service principal client ID: => the application ID copied earlier
• Service principal key: => the key generated earlier
• Tenant Id: =>
  1. Azure Active Directory
  2. Properties
  3. Copy the Directory ID

Troubleshooting

1. Clicking verify connection doesn't work?
   • Ensure that the Application Registration has been granted permissions on a resource
2. Didn't copy/forgot the App Reg password?
   • The password can be removed and recreated again, so long as any external references are updated accordingly