[BUG]: ARM template deployment az login fails when using certificate for authentication

[KKing299]

New issue checklist

• I searched for existing GitHub issues
• I read pipeline troubleshooting guide
• I checked how to collect logs

Task name

ARM template deployment

Task version

3.*

Issue Description

Same issue that we had with Azure CLI a few weeks back. ARM template deployment task needs to change the parameter "--password" with "certificate". Looks like ARM template deployment task utilizes AZ CLI for auth. That's where the issue is. Please read below the log.

We need this fixed ASAP! This is breaking all production pipelines.

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

windows-latest

Relevant log output

Log -
2024-12-10T11:57:51.4300005Z [command]C:\Windows\system32\cmd.exe /D /S /C ""C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd" login --service-principal -u *** "--password=D:\a\_temp\spnCert.pem" --tenant {REMOVED} --allow-no-subscriptions"

Full task logs with system.debug enabled

 [REPLACE THIS WITH YOUR INFORMATION] 

Repro steps

[KKing299]

Any updates, please? This is breaking production setup

[KKing299]

Any updates on this please?

[KKing299]

MS Teams - please provide an update on this. This is very critical and I've been looking for an update since more or less a month. Earlier your support teams told me that because of deploy freeze the Product team won't be able to fix it before 6th January. Today is 7th January, can please get this escalated now?

[bveldhuis]

I am also experiencing this issue, this is related to a breaking change in the Azure CLI 30283. Would be great if this can get priority to get fixed

[KKing299]

MS Teams - Can we please get some traction on this task? Would appreciate if this can be prioritized?

[LeftTwixWand]

Hey @KKing299 , @bveldhuis can you create a new Azure Resource Management service connection using Workload Identity Federation and then use this new service connection with the task?

[xhoogland]

Hi,
We, @bveldhuis and I, wish that was possible. We have an Azure DevOps Server hosted, of course, on-premise - version 2022.1. There is only 1 possibility of creating a service connection under Azure Resource Manager, which is: 'Service principal (manual)'.

[KKing299]

@LeftTwixWand - Please understand that what you're saying partially works since Workload identity Federation doesn't use the same parameter.
I CANNOT use WIF instead of certs since I use a multi tenant app registration and then delegate to N number of clients. WIF only allows 30 at one app regis.
MS would need to fix this for Cert based auth. MS already fixed it for Azure CLI task, can't this be fixed the same way for ARM template deployment task? I'd appreciate a quick response.

[bveldhuis]

Hi, We, @bveldhuis and I, wish that was possible. We have an Azure DevOps Server hosted, of course, on-premise - version 2022.1. There is only 1 possibility of creating a service connection under Azure Resource Manager, which is: 'Service principal (manual)'.

Correct, @xhoogland and I work together on this.