Use renewable Azure CLI authentication for Helix

[missymessa]

Summary

• run Entra-authenticated Helix submission and monitoring inside AzureCLI@2 with keepAzSessionActive: true
• make the Helix SDK and standalone Job Monitor prefer AzureCliCredential, while preserving the existing credential order for other Arcade consumers
• retain the Azure Pipelines service-connection variables as fallback inputs instead of rewriting or clearing them
• preserve existing PAT and anonymous behavior

Why

The original approach attempted to use AzurePipelinesCredential with the endpoint GUID resolved by AzureCLI@2. Staging builds 3079813 and 3080543 disproved that design: the OIDC request returned an Azure DevOps-issued assertion (vstoken.dev.azure.com), while the staging service connection is configured with a Microsoft Entra issuer (login.microsoftonline.com/.../v2.0), producing AADSTS700211.

addSpnToEnvironment would expose the task's current WIF assertion, but that assertion is not a renewable credential for Helix operations that may wait for hours. Instead, AzureCLI@2 maintains a renewable CLI login for the lifetime of the task. The Helix clients now explicitly prefer AzureCliCredential, then retain the existing credentials as fallbacks.

A subsequent staging canary, 3080737, proved the Azure CLI WIF login succeeds. It also exposed a second issue in the previously published SDK: managed identity ran before Azure CLI and IMDS returned a fatal Identity not found. PreferAzureCliCredential fixes that ordering for Helix only.

Compatibility

• HelixUseEntraAuthentication and useEntraAuthentication remain opt-in.
• PAT and anonymous paths are unchanged.
• Non-Helix DefaultIdentityTokenCredential consumers retain the existing credential order.
• Both Windows and Unix submission paths use the same renewable Azure CLI design.

Validation

• Microsoft.DotNet.Helix.Sdk.Tests: 328 passed, 0 failed
• Arcade PR build 1603071: succeeded, including Helix Job Monitor validation
• YAML parsing and whitespace validation succeeded for both modified templates
• corrected package-based staging canary 3083038: built Arcade head d6ec7b3f, produced and selected Microsoft.DotNet.Helix.Sdk 12.0.0-ci, authenticated through Azure CLI WIF, submitted staging Helix job 4cc4865f-6fc6-4808-96c7-ad9d60d0bbf2, and completed its work item successfully
• build 3083038 was marked partially succeeded only because the unrelated Emit Smart CI telemetry to App Insights step exited 1; the authentication canary task and Helix submission both succeeded

Rollout

Land this change in main first. PR #17589 is the release/11.0 backport and must remain draft until this PR is merged.

AB#12269

[Copilot]

🟡 Changes recommended

The documentation’s Helix Job Monitor example still instructs using a service connection ID for azureSubscription, which conflicts with the updated templates expecting a service connection name (resolved to endpoint GUID).

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR updates Arcade’s Azure DevOps Helix templates to rely on the resolved service connection (endpoint) GUID provided by AzureCLI@2 for Entra/WIF authentication, so AzurePipelinesCredential can request OIDC assertions from the correct issuer during long-running Helix operations.

Changes:

• Capture AZURESUBSCRIPTION_CLIENT_ID, AZURESUBSCRIPTION_TENANT_ID, and the resolved AZURESUBSCRIPTION_SERVICE_CONNECTION_ID from AzureCLI@2, and forward them to Helix submission/monitor processes.
• Update template parameter documentation/comments to clarify that the input is the service connection name (resolved to endpoint GUID by Azure DevOps for AzureCLI@2).
• Extend Helix sending documentation with the WIF/endpoint-ID rationale.

File summaries

File	Description
eng/common/core-templates/steps/send-to-helix.yml	Uses AzureCLI@2-provided resolved endpoint GUID and forwards it (plus client/tenant IDs) to Helix submission.
eng/common/core-templates/job/helix-job-monitor.yml	Applies the same resolved endpoint GUID forwarding for the standalone Helix Job Monitor flow.
Documentation/AzureDevOps/SendingJobsToHelix.md	Documents the WIF requirement and the endpoint-ID forwarding rationale for Entra authentication.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

It changes authentication/identity propagation in widely-consumed Azure DevOps core templates, so a final human review is warranted to mitigate rollout risk despite the changes appearing coherent and opt-in.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[mmitche]

I don't think this works. Without addSSponToEnvironment, those variables will not be available AFAIK

[missymessa]

Yup, the test build I ran came back as a failure: https://dev.azure.com/dnceng/internal/_build/results?buildId=3080543&view=results

Going to move this to draft until I can validate the changes work.

[Copilot]

🔵 Needs a closer look

It changes shared Helix authentication behavior in core pipeline templates, which is high-impact and warrants final human validation across real AzDO WIF configurations.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The implementation unsets AZURESUBSCRIPTION_* variables (disabling the AzurePipelinesCredential path) which conflicts with the PR description’s stated approach and needs reconciliation for correctness/maintainability.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Template behavior and inline comments around clearing/passing AZURESUBSCRIPTION_* need clarification/alignment to avoid maintainer confusion and apparent mismatch with the PR’s stated intent.

Review details

Suppressed comments (2)

eng/common/core-templates/steps/send-to-helix.yml:54

• The inline script clears AZURESUBSCRIPTION_* variables without any explanation. Since these variables are also the inputs that enable AzurePipelinesCredential, this behavior is non-obvious and easy to accidentally undo during future edits (and it also appears to conflict with the PR description’s mention of passing resolved IDs through). Add a short comment explaining that this is intentional to force DefaultIdentityTokenCredential to use the Azure CLI session maintained by AzureCLI@2.

        inlineScript: |
          Remove-Item Env:AZURESUBSCRIPTION_CLIENT_ID -ErrorAction SilentlyContinue
          Remove-Item Env:AZURESUBSCRIPTION_TENANT_ID -ErrorAction SilentlyContinue
          Remove-Item Env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID -ErrorAction SilentlyContinue

eng/common/core-templates/job/helix-job-monitor.yml:241

• This comment states AzurePipelinesCredential “cannot authenticate Entra-issued service connections”, but the PR description indicates the intent is to support Entra-issued WIF endpoints by resolving/passing the endpoint GUID. Even if the code still prefers Azure CLI, the current wording is absolute and can mislead future maintainers. Reword to describe the actual intent here: clearing AZURESUBSCRIPTION_* to keep DefaultIdentityTokenCredential on the Azure CLI session.

          # AzurePipelinesCredential currently receives Azure DevOps-issued assertions,
          # which cannot authenticate Entra-issued service connections. Force Arcade's
          # credential chain to use the renewable Azure CLI session maintained by this task.

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Copilot review overview

🔵 Needs a closer look

Authentication and CI template changes warrant human review, with a documentation follow-up remaining.

Review effort: Lite
Findings: 1

Open (1)

• Update SDK guidance for the service connection name contract · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

The authentication and pipeline changes require final human review.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Update SDK guidance for the service connection name contract

[Copilot]

Copilot review overview

🟡 Changes recommended

Restore the pipeline OAuth token in the Helix submission path before invoking MSBuild.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Restore pipeline OAuth token before invoking MSBuild · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

Submission paths must preserve and restore the original pipeline OAuth token so AzurePipelinesCredential fallback receives the correct token.

Review effort: Lite
Findings: 1

Open (1)

• Restore pipeline OAuth token before invoking MSBuild

[Copilot]

Copilot review overview

🔵 Needs a closer look

Broad authentication and pipeline changes warrant final human review.

Review effort: Lite
Findings: 1

Open (1)

• Restore pipeline OAuth token before invoking MSBuild

[missymessa]

@mmitche I documented the dotnet/runtime validation here: https://dev.azure.com/dnceng/internal/_workitems/edit/12269#11163075

We'll need this change to flow to dotnet/runtime first, but then we can merge dotnet/runtime#134494 after.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The authentication and CI-template changes warrant final human review.

Review effort: Lite
Findings: 1

Open (1)

• Restore pipeline OAuth token before invoking MSBuild

[Copilot]

Copilot review overview

🔵 Needs a closer look

The Azure CLI template paths do not preserve the service-connection variables required for the documented credential fallback.

Review effort: Lite
Findings: 1

Open (1)

• Restore pipeline OAuth token before invoking MSBuild