Convert to workload identity federation

If you tried to convert your service connection to use Federated Credentials, and the automatic conversion failed, don't "try again". You need to do it manually.

The easiest approach that I found

Permissions

First of all, you need to make sure you have enough permissions. According to the documentation, you must ensure that you are the Owner of the Azure Subscription used for the service connection.

That's not enough. Make sure you have at least Global Reader, too.

The script

The easiest way to convert the connection manually is to run the

az ad app federated-credential create --id $appObjectId --parameters credential.json

as described in Handling Manual Conversions.

The only tricky part is to update the credential.json correctly.

{
    "name": "__ENDPOINT_ID__",
    "issuer": "https://vstoken.dev.azure.com/__ORGANIZATION_ID__",
    "subject": "sc://__ORGANIZATION_NAME__/__PROJECT_NAME__/__SERVICE_CONNECTION_NAME__",
    "description": "Federation for Service Connection __SERVICE_CONNECTION_NAME__ in https://dev.azure.com/__ORGANIZATION_NAME__/__PROJECT_NAME__/_settings/adminservices?resourceId=__ENDPOINT_ID__",
    "audiences": [
        "api://AzureADTokenExchange"
    ]
}

ENDPOINT_ID

The issuer and subject are displayed in the "Authentication conversion" section, that appears after automatic conversion fails. The __ENDPOINT_ID__, however... you have to find it =)

Navigate to the https://dev.azure.com/{__ORGANIZATION_NAME__}/__PROJECT_NAME__/_apis/serviceendpoint/endpoints?authSchemes=ServicePrincipal&type=azurerm&includeFailed=false&includeDetails=true&api-version=7.1 to see a list of all the service connections that can be converted.
Find the one you need, and copy the id - this is your __ENDPOINT_ID__.

{
    "count": 1,
    "value": [
        {
            "data": {
                "environment": "AzureCloud",
                "scopeLevel": "Subscription",
                //...
            },
            "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
            //...
            "authorization": {
                "parameters": {
                    //...
                },
                "scheme": "ServicePrincipal"
            },
            "operationStatus": {
                "state": "Failed",
                "statusMessage": "converting_scheme_failed",
                "severity": null
            },
            "serviceEndpointProjectReferences": [
        //...
            ]
        }
    ]
}

Done?

Maybe I should have waited longer... After checking my service connection again, I still saw the blue dot, and the "conversion failed" error.

So I hit the "Try again" button again and.. lo and behold! It worked!