Service Principal with Federated Credentials Can’t Access Full Repo in ADO
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-28-2025 07:47 AM
Good Afternoon,
I’m using Databricks with Git integration to Azure DevOps (ADO).
- Authentication is via Microsoft Entra federated credentials for a service principal (SPN).
- The SPN has Basic access in ADO, is in the same project groups as my user, and Git integration is configured successfully.
- When I run jobs as my user, the entire repo is accessible.
- When I run jobs as the SPN, only the entry file specified in the job runs; other files in the repo are not accessible.
- The job source is set to a branch, not a single file.
Why does the SPN only get access to the entry file and not the full repo? Is this expected behavior for Git source jobs, or am I missing a configuration step to allow full repo checkout when using a service principal? Has anyone else experienced similar issues?
I followed steps outlined here: Use a Microsoft Entra service principal for automation with Azure Databricks Git folders - Azure Dat...
from this release: OAuth 2.0 Git credential support for Service Principals is now Generally Available | Databricks Blog
Thanks for reading!