如何用Az CLI/Az PS自动化创建Azure DevOps WIF ARM服务端点？

目前Azure CLI和Azure PowerShell确实没有原生命令直接创建这类基于OpenID Connect的工作负载身份联合（WIF）ARM服务端点，但可以通过Azure DevOps REST API实现自动化，以下是具体步骤：

1. 准备必要信息 #

• Azure DevOps组织名称、项目ID（可通过az devops project list命令获取）
• Azure租户ID、订阅ID
• 用于联合身份的Azure AD应用（服务主体）Client ID
• Azure DevOps PAT（个人访问令牌），需授予Service Connections (Read, write & manage)权限
• 自定义的服务端点名称

2. 构造REST API请求 #

使用Service Endpoints - Create API，请求地址格式：

POST https://dev.azure.com/{organization}/{project}/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4

请求体JSON示例（核心是指定authorizationType为Federated，并填充OIDC相关配置）：

{
  "name": "WIF-ARM-Service-Endpoint",
  "type": "azurerm",
  "url": "https://management.azure.com/",
  "authorization": {
    "scheme": "WorkloadIdentityFederation",
    "parameters": {
      "tenantid": "{Azure-Tenant-ID}",
      "serviceprincipalid": "{Azure-AD-App-Client-ID}",
      "authorizationType": "Federated"
    }
  },
  "data": {
    "subscriptionId": "{Azure-Subscription-ID}",
    "subscriptionName": "{Azure-Subscription-Name}",
    "environment": "AzureCloud",
    "scopeLevel": "Subscription",
    "creationMode": "Manual"
  },
  "isReady": true,
  "owner": "Library"
}

3. 执行API调用示例 #

PowerShell调用 #

$orgName = "your-org-name"
$projectId = "your-project-id"
$pat = "your-pat-token"
$headers = @{
  "Authorization" = "Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$pat"))
  "Content-Type" = "application/json"
}
$body = @{
  name = "WIF-ARM-Endpoint"
  type = "azurerm"
  url = "https://management.azure.com/"
  authorization = @{
    scheme = "WorkloadIdentityFederation"
    parameters = @{
      tenantid = "xxxx-xxxx-xxxx-xxxx"
      serviceprincipalid = "yyyy-yyyy-yyyy-yyyy"
      authorizationType = "Federated"
    }
  }
  data = @{
    subscriptionId = "zzzz-zzzz-zzzz-zzzz"
    subscriptionName = "Your-Subscription-Name"
    environment = "AzureCloud"
    scopeLevel = "Subscription"
    creationMode = "Manual"
  }
  isReady = $true
  owner = "Library"
} | ConvertTo-Json -Depth 10

Invoke-RestMethod -Uri "https://dev.azure.com/$orgName/$projectId/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4" -Method Post -Headers $headers -Body $body

curl调用 #

ORG_NAME="your-org-name"
PROJECT_ID="your-project-id"
PAT="your-pat-token"
ENCODED_PAT=$(echo -n ":$PAT" | base64)

curl -X POST \
  "https://dev.azure.com/$ORG_NAME/$PROJECT_ID/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4" \
  -H "Authorization: Basic $ENCODED_PAT" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "WIF-ARM-Service-Endpoint",
    "type": "azurerm",
    "url": "https://management.azure.com/",
    "authorization": {
      "scheme": "WorkloadIdentityFederation",
      "parameters": {
        "tenantid": "{Azure-Tenant-ID}",
        "serviceprincipalid": "{Azure-AD-App-Client-ID}",
        "authorizationType": "Federated"
      }
    },
    "data": {
      "subscriptionId": "{Azure-Subscription-ID}",
      "subscriptionName": "{Azure-Subscription-Name}",
      "environment": "AzureCloud",
      "scopeLevel": "Subscription",
      "creationMode": "Manual"
    },
    "isReady": true,
    "owner": "Library"
  }'

注意事项 #

• 确保Azure AD应用已配置好与Azure DevOps的联合身份信任：添加Federated Credential，受众设为api://AzureADTokenExchange，实体ID为Azure DevOps项目的vstfs:///Classification/TeamProject/{Project-ID}
• PAT必须具备服务连接的读写管理权限，否则会返回403权限错误
• 可根据微软官方文档确认最新的API版本，避免因版本过期导致调用失败

内容的提问来源于stack exchange，提问作者Clumsyhands