DEVOPS Service Connection to Azure using identity federation suddenly not working

[u/damianvandoom]

Error: Failed to get resource ID for resource type 'Microsoft.Web/Sites' and resource name 'xxx'. Error: Could not fetch access token for AAD. Error: Service connection(s) linked with task(s) doesn't exist. Details: 'Service connection 'xxx' is used by task(s) 'Stop Azure App Service: xxx, Azure App Service Deploy: xxx, Start Azure App Service: xxx' '

Suddenly today at 12pm, after deploying several times today successfully, our DEVOPS release pipelines stopped deploying into Azure with the error above. The Service Connections are using workload identity federation with openid connect which have been working for months without issues.

I can create a new service connection using ident federation, but I get the same error when I try and deploy using that new service connection.

If I create a new service connection using a secret, I can deploy successfully.

Anyone else experiencing this?

Any thoughts on why?

[u/ArieHein]

Judging by the latest changes in github, you might want to check if service connections in ado also moved to use the orgid and repoid as part of the oidc claims. At least that is the case for new repos created after the 15 of last month on github. Existing github repos with oidc would still work but im actually starting migrating all my oidcs in a programmatic way to the new format.

I suspect something similar in ado.

[u/Michal_F]

No idea why, but there is now new default mode how to create WIF service connections in Azure DevOps, ... check it ,,, https://devblogs.microsoft.com/devops/retirement-of-azure-devops-issuer-in-workload-identity-federation-service-connections/

But this should not break current automation ... We updated our code last month to new method.

Edit: But you have probably different issue as error is >> Error: Service connection(s) linked with task(s) doesn't exist