Synapse Workspace Deployment v2.5.0 Fails with Azure DevOps Federated Service Connection

Hi
Thank you for providing the detailed information and the troubleshooting you've already performed.

Based on the information shared, the issue does not appear to be related to the Workload Identity Federation (WIF) configuration itself. Since the same Azure Resource Manager service connection successfully authenticates in Azure CLI tasks and is able to execute Synapse CLI commands (such as listing and stopping triggers), it confirms that the federated credential, Azure DevOps OIDC token issuance, and the required Azure permissions are all configured correctly.

The failure occurs specifically within the Synapse workspace deployment@2 (v2.5.0) task while it attempts to acquire an Azure access token before the deployment starts:

Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

Based on the current product documentation and behavior, the Synapse Workspace Deployment Azure DevOps extension does not currently support Azure Resource Manager service connections that use Workload Identity Federation (OIDC). The task continues to rely on the legacy service principal authentication flow for token acquisition, which is why Azure CLI tasks succeed while the deployment task fails.

To answer your questions:

• Does Synapse workspace deployment@2 support Azure DevOps Workload Identity Federation service connections? At this time, no. The deployment task does not officially support WIF/OIDC-based Azure RM service connections.
• Is any additional configuration required? Since the Azure CLI tasks authenticate successfully using the same service connection, no additional WIF configuration is required. Your authentication setup appears to be correct.
• Is this a known limitation? Yes. The observed behavior is consistent with the current limitation of the Synapse Workspace Deployment extension rather than an issue with your service connection or permissions.

As a workaround, you can use AzureCLI@2 or Azure PowerShell tasks with the same WIF-enabled service connection to deploy your Synapse artifacts instead of using the Synapse workspace deployment@2 task.

We hope this helps clarify the behavior. If support for Workload Identity Federation is introduced in a future version of the extension, it will be announced through the Azure DevOps extension release notes and Microsoft documentation.

Our deployment currently uses TemplateForWorkspace.json generated from the Synapse publish process and is deployed via Synapse workspace deployment@2.

Since Synapse workspace deployment@2 does not support Workload Identity Federation, can you provide the Microsoft-supported Azure CLI or Azure PowerShell deployment approach that deploys the same published Synapse artifacts using a WIF-enabled Azure Resource Manager service connection?

Thank you for your follow-up.

The Synapse workspace deployment@2 task is the Microsoft-provided deployment mechanism for deploying the published TemplateForWorkspace.json and TemplateParametersForWorkspace.json generated by the Synapse publish process. At present, Microsoft has not provided an equivalent Azure CLI or Azure PowerShell command that performs the same end-to-end deployment of Synapse artifacts from the published workspace template using a Workload Identity Federation (WIF)-enabled service connection.

While Azure CLI and Azure PowerShell fully support authentication through WIF, they do not currently include a command that replaces the functionality of the Synapse workspace deployment@2 task, such as parsing the published Synapse template, resolving dependencies between artifacts, and deploying all supported Synapse resources in the same manner.

If your organization requires Workload Identity Federation today, the available options are:

• Deploy the Synapse workspace infrastructure using standard ARM/Bicep deployments where applicable, and manage Synapse artifacts separately.
• Automate deployment of individual Synapse artifacts (pipelines, datasets, linked services, triggers, notebooks, etc.) by calling the Synapse Management REST APIs or Synapse SDKs from an Azure CLI or PowerShell task authenticated with the WIF-enabled service connection. This requires custom deployment logic and does not provide feature parity with the Synapse Workspace Deployment extension.

At this time, there is no Microsoft-supported Azure CLI or Azure PowerShell script that serves as a drop-in replacement for deploying TemplateForWorkspace.json generated by the Synapse publish process using a WIF-enabled Azure Resource Manager service connection.

If seamless deployment of published Synapse templates together with WIF authentication is a requirement, we recommend submitting this as a feature request through the Azure Feedback portal or Azure DevOps Developer Community so it can be considered by the product team.

We understand this may not be the answer you were hoping for, but based on the current product capabilities, this is a known limitation rather than a configuration issue.