Azure OIDC Pulumi program in TypeScript

This example lives in the pulumi/examples repository. Check out just this directory to use it:

$ git clone --filter=blob:none --sparse https://github.com/pulumi/examples pulumi-examples
$ git -C pulumi-examples sparse-checkout set azure-ts-oidc-provider-pulumi-cloud
$ cd pulumi-examples/azure-ts-oidc-provider-pulumi-cloud

This example will create OIDC configuration between Pulumi Cloud and Azure, specifically demonstrating connectivity with Pulumi ESC. The program automates the process detailed in the Azure documentation for the following activities:

• Create a Microsoft Entra application and service principal that can access resources
• Create federated credentials

Last update: September 2025

Prerequisites#

1. Install Pulumi
2. Configure Azure credentials
3. Install Node.js
4. A Pulumi Cloud account

Deploying the example#

This Pulumi example is written as a template. It is meant to be copied via pulumi new.

1. Log in to your Pulumi Cloud account if you haven’t already:

   pulumi login

2. Copy the template to a new directory (--dir is optional; the current directory is used if omitted):

   my_dir=my-azure-oidc
   pulumi new https://github.com/pulumi/examples/azure-ts-oidc-provider-pulumi-cloud --dir ${my_dir}
   cd ${my_dir}

   Once copied to your machine, feel free to edit as needed.

3. Install dependencies:

   npm install

4. Deploy your infrastructure. This template will pick up the thumbprint from the URL that you set in the stack configuration. By default it will use the OIDC IDP URL for Pulumi Cloud.

   pulumi up

Cleaning up#

To clean up your infrastructure, run:

pulumi destroy
pulumi stack rm