https://trustanchor.pro/tags/wif/Recent content in Wif on Trust AnchorHugo -- gohugo.ioen© 2026 George VaculikSat, 25 Jul 2026 10:00:00 +0200https://trustanchor.pro/posts/secretless-ado-runners-wif/Sat, 25 Jul 2026 10:00:00 +0200https://trustanchor.pro/posts/secretless-ado-runners-wif/A build pipeline is one of the most privileged identities in your tenant — the service principals and managed identities behind it form a perimeter into the platform. Workload Identity Federation makes the pipeline auth to Azure, Microsoft Graph, other API endpoints, and Azure DevOps secret-less on any runner; a user-assigned managed identity does the same for registering a self-hosted runner. This post covers both, and why PATs, client secrets, and certificates are the credentials to design out.