
Your Azure DevOps pipelines have a 2027 deadline, and the clock has just started
As of 1st July 2026, the Azure DevOps issuer for workload identity federation is officially deprecated, with full retirement set for 1st July 2027. If that sentence meant nothing to you, here's the short version: any Azure Pipelines Service Connection you created before late 2025 probably needs attention, and if you ignore it, those pipelines will stop authenticating to Azure a year from now.
The portal will happily convert them for you, one Service Connection at a time, a couple of minutes each. That's perfectly fine if you have five. If you have several hundred (or more than about 10 if you're anything like me) then this isn't going to work.
But luckily for you I've gone through the hassle of figuring out how to programmatically call the migration.
https://sysadmin-central.com/2026/07/01/migrate-azure-devops-service-connections-entra-issuer/