Merge pull request #17780 from XpiritBV/support-azdo-identities

feat(azure): support service principals and managed identities

docs/integrations/azure/locations.md

@@ -13,6 +13,30 @@ or registered with the
 [catalog-import](https://github.com/backstage/backstage/tree/master/plugins/catalog-import)
 plugin.
 
+Using a service principal:
+
+```yaml
+integrations:
+  azure:
+    - host: dev.azure.com
+      credential:
+        clientId: ${CLIENT_ID}
+        clientSecret: ${CLIENT_SECRET}
+        tenantId: ${TENANT_ID}
+```
+
+Using a managed identity:
+
+```yaml
+integrations:
+  azure:
+    - host: dev.azure.com
+      credential:
+        clientId: ${CLIENT_ID}
+```
+
+Using a personal access token (PAT):
+
 ```yaml
 integrations:
   azure:
@@ -22,11 +46,19 @@ integrations:
 
 > Note: An Azure DevOps provider is added automatically at startup for
 > convenience, so you only need to list it if you want to supply a
-> [token](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate).
+> [token](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate),
+> a [service principal](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity),
+> or a [managed identity](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity)
 
-The configuration is a structure with two elements:
+The configuration is a structure with these elements:
 
 - `host`: The DevOps host; only `dev.azure.com` is supported.
 - `token` (optional): A personal access token as expected by Azure DevOps.
+- `credential`: (optional): A service principal or managed identity
 
-> Note: The token should just be provided as the raw token generated by Azure DevOps using the format `raw_token` with no base64 encoding. Formatting and base64'ing is handled by dependent libraries handling the Azure DevOps API
+> Note:
+>
+> - `token` and `credential` are mutually exclusive.
+> - You cannot use a service principal or managed identity for Azure DevOps Server (on-premises) organizations
+> - You can only use a service principal or managed identity for Azure AD backed Azure DevOps organizations
+> - The token should just be provided as the raw token generated by Azure DevOps using the format `raw_token` with no base64 encoding. Formatting and base64'ing is handled by dependent libraries handling the Azure DevOps API