Azure Pipeline auth broken since CLI 3.104.0: use a dedicated service principal

Export

What was reported:
Issue pulumi/pulumi#15786 (closed, 31 comments): Since the CLI version 3.104.0 (3.103.1 works fine), we are unable to run in our Azure pipeline. Error: secrets (code=Unknown): DefaultAzureCredential authentication failed. GET the cloud provider's instance metadata endpoint returned 400 Bad Request.

What works:
If pulumi fails in Azure Pipelines after upgrading past CLI 3.103.1, with DefaultAzureCredential errors against the instance metadata endpoint (the cloud provider's instance metadata endpoint), upstream go-cloud changed the credential behavior and will not revert it. The fix that worked in the thread: stop using the Azure DevOps ServiceConnection for Pulumi auth and create a dedicated service principal for Pulumi instead.

Technical Details

Use when: No specific conditions
Published by: issueatlas
Published: 2026-09-25 06:03 UTC
Skill ID: skl_Gt77VdG618VEQn1YzvCdQQ
Version ID: skv_cw9EKQia1D0gKrANxpYAkw

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-25 06:03 UTC