Merge pull request #290856 from anishtrakru/dtl-managedidentity

Add artifact repo using managed identity or GitHub app authentication

Author: v-shils

articles/devtest-labs/add-artifact-repository.md

@@ -20,17 +20,80 @@ This article shows you how to add an artifact repository to your lab by using th
 
 [!INCLUDE [updated-for-az](~/reusable-content/ce-skilling/azure/includes/updated-for-az.md)]
 
-## Prerequisites
-To add an artifact repository to a lab, you need to know the Git HTTPS clone URL and the personal access token for the GitHub or Azure Repos repository that has the artifact files.
+## Add an artifact repo
 
-### Get the clone URL and personal access token for GitHub
+You can add an artifact repo from an Azure Repos repository or a GitHub repository. You can choose to authenticate by assigning permissions to a managed identity, by using GitHub app authentication, or by using a PAT.
+To learn more about managed identities, see [What are managed identities for Azure resources?](/entra/identity/managed-identities-azure-resources/overview)
 
-1. On the home page of the GitHub repository that has your artifacts, select **Code**, and under **Clone**, copy the HTTPS URL.
-1. Select your profile image in the upper-right corner of GitHub, and then select **Settings**.
-1. On your profile page, in the left menu, select **Developer Settings**, and then select **Personal access tokens**.
-1. Select **Generate new token**.
-1. On the **New personal access token** page, under **Note**, enter an optional description for the token. Accept all the defaults, and then select **Generate token**.
-1. Save the generated token.
+Select the tab for the type of repository and authentication you want to use.
+
+## [Azure Repos repo with MSI](#tab/DevOpsRepoMSI/)
+
+To add an artifact repo, complete the following tasks:
+
+- Assign permissions in Azure Repos for the managed identity.
+- Add your artifact repository.
+
+### Assign permissions in Azure Repos for the managed identity
+
+You must give the managed identity permissions to the repository in Azure Repos.  
+
+1. Sign in to your [Azure DevOps organization](https://dev.azure.com).
+
+    > [!NOTE]
+    > Your Azure DevOps organization must be in the same directory as the Azure subscription that contains your lab.
+
+1. Select **Organization settings**.
+
+   :::image type="content" source="media/devtest-lab-add-repo/devops-organization-settings.png" alt-text="Screenshot showing the Azure DevOps organization page, with Organization Settings highlighted." lightbox="media/devtest-lab-add-repo/devops-organization-settings.png":::
+
+1. On the **Overview** page, select **Users**.
+
+   :::image type="content" source="media/devtest-lab-add-repo/devops-organization-overview.png" alt-text="Screenshot showing the Organization overview page, with Users highlighted." lightbox="media/devtest-lab-add-repo/devops-organization-overview.png":::
+
+1. On the **Users** page, select **Add users**.
+
+   :::image type="content" source="media/devtest-lab-add-repo/devops-add-user.png" alt-text="Screenshot showing the Users page, with Add user highlighted." lightbox="media/devtest-lab-add-repo/devops-add-user.png":::
+
+1. Complete **Add new users** by entering or selecting the following information, and then select **Add**:
+
+    |Name     |Value     |
+    |---------|----------|
+    |**Users or Service Principals**|Enter the name of your lab. <br> When you use a system-assigned MSI, specify the name of the lab, not the object ID of the managed account. When you use a user-assigned MSI, use the name of the managed account. |
+    |**Access level**|Select **Basic**.|
+    |**Add to projects**|Select the project that contains your repository.|
+    |**Azure DevOps Groups**|Select **Project Readers**.|
+    |**Send email invites (to Users only)**|Clear the checkbox.|
+
+   :::image type="content" source="media/devtest-lab-add-repo/devops-add-user-blade.png" alt-text="Screenshot showing Add users, with example entries and Add highlighted." lightbox="media/devtest-lab-add-repo/devops-add-user-blade.png":::
+
+### Add an Azure DevOps artifact repository to a lab in the Azure portal
+
+1. On the lab's **Overview** page, select **Configuration and policies** from the left navigation.
+
+1. On the **Configuration and policies** page, select **Repositories** under **External resources** in the left navigation.
+
+   On the **Repositories** page, the **Public Artifact Repo** is automatically present and connects to the [DevTest Labs public GitHub repository](https://github.com/Azure/azure-devtestlab). If this repo isn't enabled for your lab, you can enable it by selecting the checkbox next to **Public Artifact Repo**, and then selecting **Enable** on the top menu bar.
+
+1. To add your artifact repository to the lab, select **Add** in the top menu bar.
+
+   ![Screenshot that shows the Repositories configuration screen.](media/devtest-lab-add-repo/devtestlab-add-repo.png)
+
+1. In the **Repository** pane, enter the following information:
+
+   - **Name**: A repository name to use in the lab.
+   - **Git clone URL**: The Git HTTPS clone URL from Azure Repos.
+   - **Branch** (optional): The branch that has your artifact definitions.
+   - **Folder paths**: The folder for your ARM template definitions, relative to the Git clone URL. Be sure to include the initial forward slash in the folder path.
+   - **Managed Identity**: Use this option to leverage the Managed Identity for authentication.
+
+1. Select **Save**.
+
+   ![Screenshot that shows adding a new artifact repository to a lab.](media/devtest-lab-add-repo/devtestlab-repo-blade-with-azure-managed-identity.png)
+
+The repository now appears in the **Repositories** list for the lab.
+
+## [Azure Repos repo with PAT](#tab/DevOpsRepoPAT/)
 
 ### Get the clone URL and personal access token for Azure Repos
 
@@ -40,7 +103,7 @@ To add an artifact repository to a lab, you need to know the Git HTTPS clone URL
 1. Fill out the information for the token, selecting **Read** for the scopes, and then select **Create**.
 1. On the **Success** page, be sure to copy the token, because Azure Repos doesn't store the token or show it again.
 
-## Add an artifact repository to a lab in the Azure portal
+### Add an Azure DevOps artifact repository to a lab in the Azure portal
 
 1. On the lab's **Overview** page, select **Configuration and policies** from the left navigation.
 
@@ -52,20 +115,135 @@ To add an artifact repository to a lab, you need to know the Git HTTPS clone URL
 
    ![Screenshot that shows the Repositories configuration screen.](media/devtest-lab-add-repo/devtestlab-add-repo.png)
 
+1. In the **Repository** pane, enter the following information:
+
+   - **Name**: A repository name to use in the lab.
+   - **Git clone URL**: The Git HTTPS clone URL from Azure Repos.
+   - **Branch** (optional): The branch that has your artifact definitions.
+   - **Folder paths**: The folder for your ARM template definitions, relative to the Git clone URL. Be sure to include the initial forward slash in the folder path.
+   - **Personal access token**: The personal access token from Azure Repos.
+
+1. Select **Save**.
+
+   ![Screenshot that shows adding a new artifact repository to a lab.](media/devtest-lab-add-repo/devtestlab-repo-blade-with-azure-pat.png)
+
+The repository now appears in the **Repositories** list for the lab.
+
+## [GitHub repo DevCenter app](#tab/GitHubRepoApp/)
+
+To add an artifact repo, complete the following tasks:
+
+1. Install and configure the Microsoft Dev Center app
+1. Assign permissions in GitHub for the repos.
+1. Add your artifact repository.
+
+### Install Microsoft Dev Center app
+
+1. Sign in to the [Azure portal](https://portal.azure.com).
+
+1. Navigate to your lab.
+
+1. On the lab's **Overview** page, select **Configuration and policies** from the left navigation.
+
+1. On the **Configuration and policies** page, select **Repositories** under **External resources** in the left navigation.
+
+1. Select **Add** in the top menu bar.
+
 1. In the **Repository** pane, enter the following information:
 
    - **Name**: A repository name to use in the lab.
    - **Git clone URL**: The Git HTTPS clone URL from GitHub or Azure Repos.
+
+1. To install the Microsoft Dev Center app, select **Microsoft DevCenter GitHub app**.
+
+   :::image type="content" source="media/devtest-lab-add-repo/devtestlab-repo-select-github-app.png" alt-text="Screenshot showing Microsoft DevCenter GitHub app option on Add a repo page, with example entries and install link highlighted." lightbox="media/devtest-lab-add-repo/devtestlab-repo-select-github-app.png":::
+
+1. If you're prompted to authenticate to GitHub, authenticate.
+ 
+1. On the **Microsoft DevCenter** page, select **Install**.
+
+   :::image type="content" source="media/devtest-lab-add-repo/devtestlab-install-github-app.png" alt-text="Screenshot showing Microsoft DevCenter GitHub app installation page." lightbox="media/devtest-lab-add-repo/devtestlab-install-github-app.png":::
+ 
+1. Select the GitHub organization that contains the artifact repository you want to add to the lab. You must be an owner of the organization to install this app.
+
+   :::image type="content" source="media/devtest-lab-add-repo/devtestlab-install-github-app-select-organization.png" alt-text="Screenshot of the Install Microsoft DevCenter page, with a GitHub organization highlighted." lightbox="media/devtest-lab-add-repo/devtestlab-install-github-app-select-organization.png":::
+
+1. On the Install Microsoft DevCenter page, select **Only select repositories**, select the repository you want to add to the lab, and then select **Install**. 
+
+   :::image type="content" source="media/devtest-lab-add-repo/devtestlab-select-one-repository.png" alt-text="Screenshot of the Install Microsoft DevCenter page, with one repository selected and highlighted." lightbox="media/devtest-lab-add-repo/devtestlab-select-one-repository.png":::
+
+   You can select multiple repositories to add to the lab. You must add each repository separately to the lab, as described in this article.
+
+1. On the **Microsoft DevCenter by Microsoft would like permission to:** page, review the permissions required, and then select **Authorize Microsoft Dev Center**.
+
+   :::image type="content" source="media/devtest-lab-add-repo/devtestlab-authorize-microsoft-dev-center.png" alt-text="Screenshot of the Microsoft DevCenter by Microsoft would like permission to page, with authorize highlighted." lightbox="media/devtest-lab-add-repo/devtestlab-authorize-microsoft-dev-center.png":::
+
+### Add an GitHub artifact repository to a lab in the Azure portal
+
+1. On the lab's **Overview** page, select **Configuration and policies** from the left navigation.
+
+1. On the **Configuration and policies** page, select **Repositories** under **External resources** in the left navigation.
+
+   On the **Repositories** page, the **Public Artifact Repo** is automatically present and connects to the [DevTest Labs public GitHub repository](https://github.com/Azure/azure-devtestlab). If this repo isn't enabled for your lab, you can enable it by selecting the checkbox next to **Public Artifact Repo**, and then selecting **Enable** on the top menu bar.
+
+1. To add your artifact repository to the lab, select **Add** in the top menu bar.
+
+   ![Screenshot that shows the Repositories configuration screen.](media/devtest-lab-add-repo/devtestlab-add-repo.png)
+
+1. In the **Repository** pane, enter the following information:
+
+   - **Name**: A repository name to use in the lab.
+   - **Git clone URL**: The Git HTTPS clone URL from GitHub Repos.
+   - **Branch** (optional): The branch that has your artifact definitions.
+   - **Folder paths**: The folder for your ARM template definitions, relative to the Git clone URL. Be sure to include the initial forward slash in the folder path.
+   - **GitHub app**: Use this option to leverage GitHub app authentication.
+
+1. Select **Save**.
+
+   ![Screenshot that shows adding a new artifact repository to a lab.](media/devtest-lab-add-repo/devtestlab-repo-blade-with-github-app-auth.png)
+
+The repository now appears in the **Repositories** list for the lab.
+
+## [GitHub repo with PAT](#tab/GitHubRepoPAT/)
+
+### Get the clone URL and personal access token for GitHub
+
+1. On the home page of the GitHub repository that has your artifacts, select **Code**, and under **Clone**, copy the HTTPS URL.
+1. Select your profile image in the upper-right corner of GitHub, and then select **Settings**.
+1. On your profile page, in the left menu, select **Developer Settings**, and then select **Personal access tokens**.
+1. Select **Generate new token**.
+1. On the **New personal access token** page, under **Note**, enter an optional description for the token. Accept all the defaults, and then select **Generate token**.
+1. Save the generated token.
+
+### Add a GitHub artifact repository to a lab in the Azure portal
+
+1. On the lab's **Overview** page, select **Configuration and policies** from the left navigation.
+
+1. On the **Configuration and policies** page, select **Repositories** under **External resources** in the left navigation.
+
+   On the **Repositories** page, the **Public Artifact Repo** is automatically present and connects to the [DevTest Labs public GitHub repository](https://github.com/Azure/azure-devtestlab). If this repo isn't enabled for your lab, you can enable it by selecting the checkbox next to **Public Artifact Repo**, and then selecting **Enable** on the top menu bar.
+
+1. To add your artifact repository to the lab, select **Add** in the top menu bar.
+
+   ![Screenshot that shows the Repositories configuration screen.](media/devtest-lab-add-repo/devtestlab-add-repo.png)
+
+1. In the **Repository** pane, enter the following information:
+
+   - **Name**: A repository name to use in the lab.
+   - **Git clone URL**: The Git HTTPS clone URL from GitHub Repos.
    - **Branch** (optional): The branch that has your artifact definitions.
-   - **Personal access token**: The personal access token from GitHub or Azure Repos.
    - **Folder paths**: The folder for your ARM template definitions, relative to the Git clone URL. Be sure to include the initial forward slash in the folder path.
+   - **Personal access token**: The personal access token from GitHub Repos.
+
 
 1. Select **Save**.
 
-   ![Screenshot that shows adding a new artifact repository to a lab.](media/devtest-lab-add-repo/devtestlab-repo-blade.png)
+   ![Screenshot that shows adding a new artifact repository to a lab.](media/devtest-lab-add-repo/devtestlab-repo-blade-with-github-pat.png)
 
 The repository now appears in the **Repositories** list for the lab.
 
+---
+
 ## Add an artifact repository by using an ARM template
 
 ARM templates are JSON files that describe Azure resources to create. For more information about ARM templates, see [Understand the structure and syntax of ARM templates](../azure-resource-manager/templates/syntax.md).
@@ -323,7 +501,7 @@ The PowerShell script takes the following parameters:
 | `LabName` | The name of the lab. |
 | `ArtifactRepositoryName` | Name for the new artifact repository. The script creates a random name for the repository if it isn't specified. |
 | `ArtifactRepositoryDisplayName` | Display name that appears in the lab's artifact repository list. |
-| `RepositoryUri` | URI of the artifact repository, which you copied earlier.
+| `RepositoryUri` | URI of the artifact repository, which you copied earlier.|
 | `RepositoryBranch` | Repository branch that contains the artifacts. The default value is `main`.|
 | `FolderPath` | Folder that contains the artifacts. The default value is: `/Artifacts`.|
 | `PersonalAccessToken` | Security token for accessing the repository, which you copied earlier.|