gofrontier-com / sheriff-azure-devops-extension

An Azure DevOps extension to simplify use of Sheriff, a command line tool to manage Microsoft Entra Privileged Identity Management (Microsoft Entra PIM) using desired state configuration.

Sheriff Azure DevOps Extension

About

This is an Azure DevOps extension that provides tasks for installing and running Sheriff, a command line tool to manage Azure role-based access control (Azure RBAC) and Microsoft Entra Privileged Identity Management (Microsoft Entra PIM) using desired state configuration.

Installation

The extension is available in the Visual Studio Marketplace.

Usage

InstallSheriffCLI task

This task installs the Sheriff CLI on the agent. The version input accepts either latest or a specific version number in the format vA.B.C, e.g. v0.1.0.

- task: InstallSheriffCLI@0
  displayName: Install Sheriff CLI
  inputs:
    version: latest

SheriffPlan task

This task runs Sheriff in plan mode, equivalent to running sheriff plan [mode].

- task: SheriffPlan@0
  displayName: Plan Sheriff changes
  inputs:
    configDir: $(System.DefaultWorkingDirectory)/.config
    mode: azurerm
    serviceConnectionName: <service connection name>

SheriffApply task

This task runs Sheriff in apply mode, equivalent to running sheriff apply [mode].

- task: SheriffApply@0
  displayName: Apply Sheriff changes
  inputs:
    configDir: $(System.DefaultWorkingDirectory)/.config
    mode: azurerm
    serviceConnectionName: <service connection name>

Contributing

We welcome contributions to this repository. Please see CONTRIBUTING.md for more information.

sheriff-azure-devops-extension's Issues

Plan and Apply tasks don't support Workload Identity

Plan and Apply tasks don't support using a service connection backed by Workload Identity.

https://devblogs.microsoft.com/premier-developer/azure-devops-workload-identity-federation/