Azure DevOps构建流水线资源授权问题：服务连接变量引用失败

原流水线YAML配置 #

trigger:
- none

pr:
- none

pool:
  vmImage: "windows-latest"

variables:
  group: my_variable_group # 此处包含目标Azure Function信息（订阅、资源组、函数名称等）
  buildPath: $(System.DefaultWorkingDirectory)/pipelines/maintenance
  buildConfiguration: 'Release'
  dotNetVersion: '6.0.x'
  output: 'output'
  project: '**/project.csproj'
  
steps:

- task: UseDotNet@2
  displayName: 'Use .NET Core SDK'
  inputs:
    packageType: 'sdk'
    version: $(dotNetVersion)

- task: DotNetCoreCLI@2
  displayName: 'Restore Packages'
  inputs:
    command: restore
    projects: $(project)

- script: |
    dotnet build --configuration $(buildConfiguration)
  workingDirectory: $(buildPath)
  displayName: 'Build'

- task: DotNetCoreCLI@2
  displayName: 'Publish'
  inputs:
    command: publish
    arguments: '--configuration $(buildConfiguration) --output $(output)'
    projects: $(buildPath)
    publishWebProjects: false
    modifyOutputPath: false
    zipAfterPublish: false

- task: ArchiveFiles@2
  displayName: 'Archive files'
  inputs:
    rootFolderOrFile: $(System.DefaultWorkingDirectory)/$(output)
    includeRootFolder: false
    archiveFile: $(System.DefaultWorkingDirectory)/build.zip

- task: PublishBuildArtifacts@1
  displayName: 'Publish Build Artifacts'
  inputs:
    PathtoPublish: $(System.DefaultWorkingDirectory)/build.zip
    artifactName: 'content-maintenance'

# 问题出在此处：使用变量组中的变量引用服务连接
- task: AzureFunctionApp@1
  displayName: 'Azure Function App Deploy'
  inputs:
    azureSubscription: $(Subscription)
    appType: functionApp
    appName: $(AppName)
    deployToSlotOrASE: true
    resourceGroupName: $(ResourceGroup)
    slotName: $(Slot)
    deploymentMethod: zipDeploy

- task: AzureAppServiceSettings@1
  displayName: 'Azure App Service Settings'
  inputs:
    azureSubscription: $(Subscription)
    appName: $(AppName)
    resourceGroupName: $(ResourceGroup)
    slotName: $(Slot)
    appSettings: |
     [
       {
         "name": "AzureWebJobsStorage",
         "value": $(AzureWebJobsStorage),
         "slotSetting": false
       },
       {
         "name": "VaultUri",
         "value": $(VaultUri),
         "slotSetting": false
       },
       {
         "name": "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING",
         "value": $(WEBSITE_CONTENTAZUREFILECONNECTIONSTRING),
         "slotSetting": false
       },
       {
         "name": "WEBSITE_CONTENTSHARE",
         "value": $(WEBSITE_CONTENTSHARE),
         "slotSetting": false
       }
     ]

错误信息 #

资源授权问题："The pipeline is not valid.
Job Job: Step AzureFunctionApp input azureSubscription references
service connection $(Subscription) which could not be found. The
service connection does not exist or has not been authorized for use.
For authorization details, refer to https://aka.ms/yamlauthz. Job Job:
Step AzureAppServiceSettings input ConnectedServiceName references
service connection $(Subscription) which could not be found. The
service connection does not exist or has not been authorized for use.
For authorization details, refer to https://aka.ms/yamlauthz."

解决方案 #

问题核心是Azure DevOps在流水线初始化阶段就需要解析服务连接名称，而变量组的变量是在运行时才展开的，直接用$(Subscription)无法在初始化阶段匹配到具体的服务连接。以下是可行的解决方法：

1. 使用流水线参数传递服务连接名称（推荐） #

将服务连接名称作为流水线参数，初始化阶段即可解析到具体值：

• 在YAML开头添加参数定义：

  parameters:
    - name: serviceConnectionName
      type: string
      description: "Azure服务连接的显示名称"
  

• 修改部署任务中的azureSubscription字段，使用参数引用：

  azureSubscription: ${{ parameters.serviceConnectionName }}
  

• 运行流水线时，在参数界面填入对应的服务连接名称即可。

2. 验证变量组与服务连接的匹配性 #

如果坚持使用变量组：

• 确保变量组中Subscription变量的值是服务连接的显示名称（大小写敏感，需完全一致，不能是订阅ID或服务连接ID）
• 改用变量组的完全引用语法：$[variables['my_variable_group.Subscription']]，但这种方式仍可能受限于初始化解析逻辑，稳定性不如参数方式。

3. 确认服务连接权限 #

• 进入项目设置 -> 服务连接，找到目标服务连接
• 点击「管理权限」，确保当前流水线或流水线所属的用户/服务主体拥有「使用」权限

4. 阶段级变量组（备选方案） #

将部署阶段拆分为独立阶段，在阶段内引用变量组，但同样需要确保服务连接名称能被提前解析：

stages:
- stage: Build
  jobs:
  - job: BuildJob
    pool:
      vmImage: "windows-latest"
    variables:
      buildPath: $(System.DefaultWorkingDirectory)/pipelines/maintenance
      # 其他构建变量...
    steps:
      # 构建步骤...

- stage: Deploy
  jobs:
  - job: DeployJob
    pool:
      vmImage: "windows-latest"
    variables:
      group: my_variable_group
    steps:
      # 部署步骤...

内容的提问来源于stack exchange，提问作者delucaezequiel