title: Azure Build Pipeline - How to Grant Access to Storage Accounts?
body: <p><strong>Goal:</strong></p>
  <p>Securely get Azure resources by tag from Azure pipeline.</p>
  <p><strong>Details:</strong></p>
  <p>I have an <code>azure-pipelines.yaml</code> that builds a static website and saves it to a hard-coded storage account. This is a security vulnerability.</p>
  <p>I now need to update the file to handle blue-green deployments, <code>azure-pipelines.yaml</code> will need to get the storage account that's tagged as the current production storage account, i.e. something like (just a bash script)</p>
  <p><code>prod_storage_acct_name=$(az resource list --is_prod=true --query [0].name)</code></p>
  <p>This works, BUT, it requires a prior <code>az login -u $un -p $pwd</code>, which I test with my user. Obviously I am not going to put my personal user in the pipeline, so the questions are...</p>
  <p><strong>Questions:</strong></p>
  <ol>
  <li>Is the best way to get an Azure pipeline access to another resource a service principal acct?</li>
  <li>Do pipelines have some built in way to configure their access WITHOUT specifying a distinct service principal, since they are &quot;built in&quot; Azure processes? (<a href="https://stackoverflow.com/questions/57805778/get-own-service-principal-name-in-an-azure-devops-powershell-pipeline-task/58820706#58820706">Get own Service Principal Name in an Azure DevOps Powershell pipeline task</a> seems to imply that a service principal is built in)</li>
  <li>Is there some better way to do this that I am completely missing?</li>
  </ol>
  <p>IF I need to go with #1, what's the best security practice here? Do I just throw the service principal password into key vault and reference it in the build script?</p>
  <hr />
  <p>Maybe an intuitive way of asking: Is there any way to basically say &quot;I am a pipeline, I live on Azure, let me use my own access for this query&quot;?</p>