Follow the post below to configure\u00a0Visual Studio Team Services to communicate with Azure in order to provision or deploy Azure Resource Manager resources such as virtual machines<\/p>\n
- \n
- To setup Azure Service end point in VSTS, from your Visual Studio Account, navigate to your Team Project and click on gear icon.<\/li>\n<\/ul>\n
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/3821.task4-step1.png\")
<\/p>\n\u00a0<\/p>\n
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/7571.task4-step2.png\")
<\/p>\n- \n
- Navigate to Services tab and click on ‘New Service Endpoint’ in the left pane.<\/li>\n
- From the drop-down, select ‘Azure Resource Manager’ option.<\/li>\n<\/ul>\n
Now, setting up an Azure Service endpoint is easy, you just need to select the subscription on which to create a service endpoint, and you are ready to deploy to Azure.<\/strong><\/p>\n
![\"Auto](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/SPNMSA-300x185.png\")
Note<\/strong>:<\/p>\nA new Azure Service Principal will be created and assigned with the ‘Contributor’ role. The default role assignment will have\u00a0access to all the resources in the selected subscription. You can modify the Service Principal access from Azure portal <\/a>> Subscriptions > Users > Roles.<\/p>\n
If your subscription is not listed or to specify an existing service principal, click the link in the dialog, which will switch to manual entry mode.<\/p>\n
\u00a0<\/p>\n
\nManual configuration:<\/h3>\n
Follow the post below to manually configure\u00a0Visual Studio Team Services<\/p>\n
- \n
- Download & run this PowerShell script<\/span><\/a><\/span> in an Azure Powershell window to generate required data for Service Principal based Azure service connection. Running this script would prompt you for: \n
- \n
- The name of your Azure Subscription name<\/li>\n
- A password that you would like to set for the Service Principal that is going to be created<\/li>\n
- Note: the script has been tested with Azure PowerShell version 1.0.2<\/a>.<\/li>\n<\/ul>\n<\/li>\n
- Once successful, the script would output the following details for the Azure Service Endpoint. \n
- \n
- Connection Name<\/li>\n
- Subscription Id<\/li>\n
- Subscription Name<\/li>\n
- Service Principal Client Id<\/li>\n
- Service Principal key<\/li>\n
- Tenant Id<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
To setup Azure Service end point in VSTS, from your Visual Studio Account, navigate to your Team Project and click on gear icon.<\/p>\n
<\/p>\n- \n
- Click Services tab and click on ‘New Service Endpoint’ in the left pane.<\/li>\n<\/ul>\n<\/p>\n
- \n
- From the drop-down, select ‘Azure Resource Manager’ option. In the dialog, click the link at end of the text “If your subscription is not listed or to specify an existing service principal, click here”, which will switch to manual entry mode. You can always switch back to “Auto creation of SPN mode” by clicking the link in the manual mode dialog.<\/li>\n<\/ul>\n
![\"AzureSPN03\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/AzureSPN03-300x250.png\")
<\/p>\n- \n
- Enter the input values that you generated from the PowerShell<\/li>\n
- Click \u2018OK\u2019\u2019. We now have established a connection to Azure from your VSTS account.<\/li>\n
- From Build\/Release hub, now you add “Resource Group Deployment Task” (for example) and use the subscription.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/6558.task4-step4.png\")
<\/li>\n<\/ul>\nNote: the script has been tested with Azure PowerShell version 1.0.2<\/a>.<\/p>\n
\u00a0<\/p>\n
\nThe above steps are sufficient for the purpose described. If you would like to rather create the service principal on your own instead of using the above script<\/em><\/strong>, then follow these steps below:<\/p>\n
- \n
- To create an Azure Active Directory application, login to your Azure account through the classic portal<\/a>.<\/li>\n
- Select Active Directory from the left pane.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/7144.task1-step2.png\")
<\/li>\n- Select the directory that you want to use for creating the new application.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/5305.task1-step3.png\")
<\/li>\n- To add a new application in your directory, click on Applications and click on Add.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/6082.task1-step4.png\")
<\/li>\n- Choose “Add an application that my organization is developing”.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/0383.task1-step4-2.png\")
<\/li>\n- Select WEB APPLICATION AND\/OR WEB API and click the next button.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/0550.task1-step5.png\")
Though we intend to automate Azure Resource Group deployment from VSTS, we will have to create a Web App and use its service principal to authenticate with Azure Resource Manager.<\/li>\n- Enter a recognizable URL as we will need it later for role assignment.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/0640.task1-step6.png\")
<\/li>\n- The existence of the web-site is not validated. We are registering a web app name-space so that we can create a Service Principal identity for the application.<\/li>\n
- Congratulations, you now have an AAD Application. Click on the CONFIGURE tab:
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/1072.task1-step7.png\")
<\/li>\n- To create your service principal password, from CONFIGURE tab, find Client ID and copy it. This will be your Service Principal user name.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/8053.task2-step1.png\")
<\/li>\n- From the “keys” section, from the drop-down select 1 or 2 year duration.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/3465.task2-step2.png\")
<\/li>\n- After you hit save at the bottom, it will display your key, which is basically your Service Principal account password. Copy and store the key value. You won’t be able to retrieve it later.<\/li>\n
- Retrieve Tenant ID for your Azure account. Click “View End-Points” on the bottom panel.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/8322.task2-step3.png\")
<\/li>\n- Copy any of the URLs displayed in the pop-up dialog, The GUID in there is your tenant ID, which you’ll need later.https:\/\/login.microsoftonline.com\/72921e51-521b-439d-8412-XXXXXXXXXXXX<\/span>\/federationmetadata\/2007-06\/federationmetadata.xml <\/a><\/li>\n
- Now we have Service Principal account username, password and tenant id. Client ID: a63e0985-XXXX-XXXX-XXXX-XXXXXXXXXXXX Key: JjLsHGuoQKnWTqv4\/C8Abyg8dQ1eqjXXXXXXXXXXX= Tenant ID: 72921e51-521b-439d-8412-XXXXXXXXXXXX ****<\/li>\n
- You have now created a service principal in the directory, but the service does not have any permissions or scope assigned. You will need to explicitly grant the service principal permissions to perform operations at some scope. You will need to use http:\/\/azure.microsoft.com\/en-us\/documentation\/articles\/install-configure-powershell\/<\/a>. Log in as your Microsoft identity in order to grant roles to your Service Principal identity.
PS C:>Switch-AzureMode -Name AzureResourceManager\nPS C:>Add-AzureAccount # This will pop up a login dialog\n<\/code><\/li>\n<\/code>Assign roles to your Service Principal. For now, giving it access to the whole subscription. You can limit the access by providing the scope parameter. You can use either App ID Uri or Client ID as the value for the -ServicePrincipalName parameter.PS C:>New-AzureRoleAssignment -ServicePrincipalName <a href=\"http:\/\/RNWebAppforVSO\">http:\/\/RNWebAppforVSO<\/a> -RoleDefinitionName Contributor\n<\/code><\/li>\n<\/code>If you run Get-AzureRoleAssignment, you should see the assignment.<\/li>\n- Above commands work with older version Azure PS modules. If you are on latest Azure ARM PS modules, you need to use equivalent RM command-lets. For example, Add-AzureRMAccount, New-AzureRMRoleAssignment etc.<\/li>\n
- You could also do role assignment to your application from the new Azure portal<\/a>. Click Browse and select Subscriptions. Select the subscription you are using. Click the Access button.
![\"\"](\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2015\/10\/3187.SPN-Roles.png\")
Click Add. Select Contributor as the role. Search and select the name of the application you just created. Click OK to grant the service principal access to your subscription.<\/li>\n<\/ul>\n\u00a0<\/p>\n
Resources:<\/strong><\/p>\n
- \n
- Create new Azure Service Principal using Azure Portal<\/a><\/li>\n
- Role-based access control in the Microsoft Azure portal<\/a><\/li>\n
- Sample Azure deployment templates from GitHub quickstart-templates<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
Connect\u00a0your Azure subscriptions to VSTS in 3 clicks New improved user experience to setup Azure Resource Manager based service connection in VSTS. Follow the post below to configure\u00a0Visual Studio Team Services to communicate with Azure in order to provision or deploy Azure Resource Manager resources such as virtual machines To setup Azure Service end point […]<\/p>\n","protected":false},"author":67,"featured_media":45953,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[224,226,1],"tags":[],"class_list":["post-9941","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-ci","category-devops"],"acf":[],"blog_post_summary":"
Connect\u00a0your Azure subscriptions to VSTS in 3 clicks New improved user experience to setup Azure Resource Manager based service connection in VSTS. Follow the post below to configure\u00a0Visual Studio Team Services to communicate with Azure in order to provision or deploy Azure Resource Manager resources such as virtual machines To setup Azure Service end point […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/9941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/users\/67"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/comments?post=9941"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/9941\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media\/45953"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media?parent=9941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/categories?post=9941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/tags?post=9941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Role-based access control in the Microsoft Azure portal<\/a><\/li>\n
- Select Active Directory from the left pane.
- To create an Azure Active Directory application, login to your Azure account through the classic portal<\/a>.<\/li>\n
- From the drop-down, select ‘Azure Resource Manager’ option. In the dialog, click the link at end of the text “If your subscription is not listed or to specify an existing service principal, click here”, which will switch to manual entry mode. You can always switch back to “Auto creation of SPN mode” by clicking the link in the manual mode dialog.<\/li>\n<\/ul>\n
- Click Services tab and click on ‘New Service Endpoint’ in the left pane.<\/li>\n<\/ul>\n
- Once successful, the script would output the following details for the Azure Service Endpoint. \n
- Download & run this PowerShell script<\/span><\/a><\/span> in an Azure Powershell window to generate required data for Service Principal based Azure service connection. Running this script would prompt you for: \n