I will try to elaborate a lite about those topics.
When secret expires and you got error, you have to refresh connection. Go to Edit dialog for connection and save without any changes. Described here: Azure devops service connection expired and cannot edit/renew
But I have already tested scenario when I delete all secrets assigned to service principal used ...
What you need here are the az ad app permission commands.
Here is a complete example (assuming powershell):
$apiId = "00000002-0000-0000-c000-000000000000" # Windows Azure Active Directory
$apiPermissionsId = "78c8a3c8-a07e-4b9e-af1b-b5ccab50a175" # Directory.ReadWrite.All
$spn = az ad sp create-for-rbac --role="Owner" --name blah | ConvertFrom-Json
My problem resolves down to an issue with group policy, and is likely to be solved with the same answer as this question:
i.e. the required permissions for become to work on Windows, seem to be:
Allow Logon as a Service
Allow Logon Locally
The service principal you created actually exists in your AAD. When it expires, then AAD will stop authorizing any token requests that AAD gets for that SP. So yes, then Azure Devops will start failing auth when it tries to do work.
The SP exists 100% independently of the user that created it so it will persist if the user that created it is deleted.
Yes, you just need a Read Only Domaine Controler (search for RODC) in the vpc and you'll be able to have a one way replication as the read only controler won't need to send datas back.
This bring limitation for clients in the vpc, as they won't be able to reach a writable DC they can't change passwords and you'll need a careful site architecture in your ...