missymessa · Sep 22, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
diff --git a/eng/pipelines/cdac/cdac-helix-test-leg.yml b/eng/pipelines/cdac/cdac-helix-test-leg.yml
@@ -83,6 +83,9 @@ jobs:
         parameters:
           displayName: ${{ parameters.sendDisplayName }}
           sendParams: ${{ parameters.sendParams }}
+          useEntraAuthentication: ${{ eq(variables['helixUseEntraAuthentication'], true) }}
+          azureSubscription: ${{ variables.helixAzureSubscription }}
+          helixBaseUri: ${{ variables.helixBaseUri }}
           environment:
             _Creator: dotnet-bot
             SYSTEM_ACCESSTOKEN: $(System.AccessToken)

diff --git a/eng/pipelines/common/templates/helix-job-monitor.yml b/eng/pipelines/common/templates/helix-job-monitor.yml
@@ -0,0 +1,35 @@
+parameters:
+- name: helixAccessToken
+  type: string
+  default: ''
+- name: timeoutInMinutes
+  type: number
+  default: 480
+- name: testResultUploadParallelism
+  type: number
+  default: 48
+- name: allowNoHelixJobs
+  type: boolean
+  default: false
+- name: useEntraAuthentication
+  type: boolean
+  default: false
+- name: azureSubscription
+  type: string
+  default: ''
+- name: helixBaseUri
+  type: string
+  default: ''
+
+jobs:
+- template: /eng/common/core-templates/job/helix-job-monitor.yml
+  parameters:
+    timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
+    testResultUploadParallelism: ${{ parameters.testResultUploadParallelism }}
+    allowNoHelixJobs: ${{ parameters.allowNoHelixJobs }}
+    helixBaseUri: ${{ coalesce(parameters.helixBaseUri, variables.helixBaseUri, 'https://helix.dot.net/') }}
+    ${{ if or(eq(parameters.useEntraAuthentication, true), eq(variables['helixUseEntraAuthentication'], true)) }}:
+      useEntraAuthentication: true
+      azureSubscription: ${{ coalesce(parameters.azureSubscription, variables.helixAzureSubscription) }}
+    ${{ else }}:
+      helixAccessToken: ${{ parameters.helixAccessToken }}
diff --git a/eng/pipelines/common/templates/runtimes/send-to-helix-inner-step.yml b/eng/pipelines/common/templates/runtimes/send-to-helix-inner-step.yml
@@ -1,22 +1,66 @@
 parameters:
   osGroup: ''
   sendParams: ''
-  condition: ''
+  condition: true
   displayName: ''
   environment: {}
   shouldContinueOnError: false
+  useEntraAuthentication: false
+  azureSubscription: ''
+  helixBaseUri: 'https://helix.dot.net/'
 
 steps:
-- ${{ if eq(parameters.osGroup, 'windows') }}:
-  - powershell: $(Build.SourcesDirectory)\eng\common\msbuild.ps1 --restore -ci -warnaserror 0 ${{ parameters.sendParams }}
+- ${{ if and(eq(parameters.useEntraAuthentication, true), eq(parameters.azureSubscription, '')) }}:
+  - pwsh: throw "azureSubscription must be set when useEntraAuthentication is true."
+    displayName: Validate Helix Entra authentication
+    condition: and(succeeded(), ${{ parameters.condition }}, ${{ ne(parameters.sendParams, '') }})
+
+- ${{ if eq(parameters.useEntraAuthentication, true) }}:
+  - task: AzureCLI@2
     displayName: ${{ parameters.displayName }} (Windows)
-    condition: and(succeeded(), ${{ and(ne(parameters.condition, false), ne(parameters.sendParams, '')) }})
-    env: ${{ parameters.environment }}
+    inputs:
+      azureSubscription: ${{ parameters.azureSubscription }}
+      keepAzSessionActive: true
+      scriptType: pscore
+      scriptLocation: inlineScript
+      inlineScript: >
+        $(Build.SourcesDirectory)\eng\common\msbuild.ps1
+        --restore
+        -ci
+        -warnaserror 0
+        /p:HelixUseEntraAuthentication=true
+        ${{ parameters.sendParams }}
+    condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'), ${{ parameters.condition }}, ${{ ne(parameters.sendParams, '') }})
+    env:
+      ${{ insert }}: ${{ parameters.environment }}
+      HelixBaseUri: ${{ parameters.helixBaseUri }}
     continueOnError: ${{ eq(parameters.shouldContinueOnError, true) }}
 
-- ${{ if ne(parameters.osGroup, 'windows') }}:
-  - script: $(Build.SourcesDirectory)/eng/common/msbuild.sh --restore --ci --warnaserror false ${{ parameters.sendParams }}
+  - task: AzureCLI@2
     displayName: ${{ parameters.displayName }} (Unix)
-    condition: and(succeeded(), ${{ and(ne(parameters.condition, false), ne(parameters.sendParams, '')) }})
-    env: ${{ parameters.environment }}
+    inputs:
+      azureSubscription: ${{ parameters.azureSubscription }}
+      keepAzSessionActive: true
+      scriptType: bash
+      scriptLocation: inlineScript
+      inlineScript: >
+        $(Build.SourcesDirectory)/eng/common/msbuild.sh
+        --restore
+        --ci
+        --warnaserror false
+        /p:HelixUseEntraAuthentication=true
+        ${{ parameters.sendParams }}
+    condition: and(succeeded(), ne(variables['Agent.OS'], 'Windows_NT'), ${{ parameters.condition }}, ${{ ne(parameters.sendParams, '') }})
+    env:
+      ${{ insert }}: ${{ parameters.environment }}
+      HelixBaseUri: ${{ parameters.helixBaseUri }}
+    continueOnError: ${{ eq(parameters.shouldContinueOnError, true) }}
+
+- ${{ else }}:
+  - script: $(_msbuildCommand) $(_warnAsErrorParamHelixOverride) -restore /p:HelixUseEntraAuthentication=false ${{ parameters.sendParams }}
+    displayName: ${{ parameters.displayName }}
+    condition: and(succeeded(), ${{ parameters.condition }}, ${{ ne(parameters.sendParams, '') }})
+    env:
+      ${{ insert }}: ${{ parameters.environment }}
+      HelixBaseUri: ${{ parameters.helixBaseUri }}
     continueOnError: ${{ eq(parameters.shouldContinueOnError, true) }}
diff --git a/eng/pipelines/common/templates/runtimes/send-to-helix-step.yml b/eng/pipelines/common/templates/runtimes/send-to-helix-step.yml
@@ -55,10 +55,14 @@ steps:
     condition: and(succeeded(), ${{ parameters.condition }})
     shouldContinueOnError: ${{ parameters.shouldContinueOnError }}
     displayName: ${{ parameters.displayName }}
+    useEntraAuthentication: ${{ eq(variables['helixUseEntraAuthentication'], true) }}
+    azureSubscription: ${{ variables.helixAzureSubscription }}
+    helixBaseUri: ${{ variables.helixBaseUri }}
     environment:
       _Creator: ${{ parameters.creator }}
       _PublishTestResults: ${{ parameters.publishTestResults }}
-      _HelixAccessToken: ${{ parameters.helixAccessToken }}
+      ${{ if ne(variables['helixUseEntraAuthentication'], true) }}:
+        _HelixAccessToken: ${{ parameters.helixAccessToken }}
       _HelixBuild: ${{ parameters.helixBuild }}
       _HelixSource: ${{ parameters.helixSource }}
       _HelixTargetQueues: ${{ join(',', parameters.helixQueues) }}

diff --git a/eng/pipelines/common/variables.yml b/eng/pipelines/common/variables.yml
@@ -48,6 +48,13 @@ variables:
 - name: enableHelixJobMonitor
   value: false
 
+- name: helixUseEntraAuthentication
+  value: false
+- name: helixAzureSubscription
+  value: ''
+- name: helixBaseUri
+  value: https://helix.dot.net/
+
 - name: debugOnPrReleaseOnRolling
   ${{ if ne(variables['Build.Reason'], 'PullRequest') }}:
     value: Release

diff --git a/eng/pipelines/coreclr/ci.yml b/eng/pipelines/coreclr/ci.yml
@@ -42,7 +42,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/crossgen2-composite.yml b/eng/pipelines/coreclr/crossgen2-composite.yml
@@ -13,7 +13,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/crossgen2-gcstress.yml b/eng/pipelines/coreclr/crossgen2-gcstress.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/crossgen2-outerloop.yml b/eng/pipelines/coreclr/crossgen2-outerloop.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/crossgen2.yml b/eng/pipelines/coreclr/crossgen2.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/gc-longrunning.yml b/eng/pipelines/coreclr/gc-longrunning.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/gc-simulator.yml b/eng/pipelines/coreclr/gc-simulator.yml
@@ -23,7 +23,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/gc-standalone.yml b/eng/pipelines/coreclr/gc-standalone.yml
@@ -23,7 +23,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/gcstress-extra.yml b/eng/pipelines/coreclr/gcstress-extra.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/gcstress0x3-gcstress0xc.yml b/eng/pipelines/coreclr/gcstress0x3-gcstress0xc.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/hardware-intrinsics-arm64.yml b/eng/pipelines/coreclr/hardware-intrinsics-arm64.yml
@@ -26,7 +26,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/hardware-intrinsics.yml b/eng/pipelines/coreclr/hardware-intrinsics.yml
@@ -27,7 +27,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/interpreter.yml b/eng/pipelines/coreclr/interpreter.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/libraries-gcstress-extra.yml b/eng/pipelines/coreclr/libraries-gcstress-extra.yml
@@ -22,7 +22,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/libraries-gcstress0x3-gcstress0xc.yml b/eng/pipelines/coreclr/libraries-gcstress0x3-gcstress0xc.yml
@@ -28,7 +28,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/libraries-interpreter.yml b/eng/pipelines/coreclr/libraries-interpreter.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/libraries-jitstress-random.yml b/eng/pipelines/coreclr/libraries-jitstress-random.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/libraries-jitstress.yml b/eng/pipelines/coreclr/libraries-jitstress.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/libraries-jitstress2-jitstressregs.yml b/eng/pipelines/coreclr/libraries-jitstress2-jitstressregs.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/libraries-jitstressregs.yml b/eng/pipelines/coreclr/libraries-jitstressregs.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/libraries-pgo.yml b/eng/pipelines/coreclr/libraries-pgo.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/r2r-extra.yml b/eng/pipelines/coreclr/r2r-extra.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/r2r.yml b/eng/pipelines/coreclr/r2r.yml
@@ -23,7 +23,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/release-tests.yml b/eng/pipelines/coreclr/release-tests.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 720

diff --git a/eng/pipelines/coreclr/runincontext.yml b/eng/pipelines/coreclr/runincontext.yml
@@ -21,7 +21,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/runtime-nativeaot-outerloop.yml b/eng/pipelines/coreclr/runtime-nativeaot-outerloop.yml
@@ -48,7 +48,7 @@ extends:
     - stage: Build
       jobs:
       - ${{ if eq(variables['enableHelixJobMonitor'], true) }}:
-        - template: /eng/common/core-templates/job/helix-job-monitor.yml
+        - template: /eng/pipelines/common/templates/helix-job-monitor.yml
           parameters:
             helixAccessToken: $(HelixApiAccessToken)
             timeoutInMinutes: 540

diff --git a/eng/pipelines/coreclr/templates/crossgen2-comparison-job.yml b/eng/pipelines/coreclr/templates/crossgen2-comparison-job.yml
@@ -111,7 +111,12 @@ jobs:
         HelixSource: $(_HelixSource)
         HelixType: 'test/crossgen-comparison/'
         ${{ if eq(variables['System.TeamProject'], 'internal') }}:
-          HelixAccessToken: $(HelixApiAccessToken)
+          ${{ if eq(variables['helixUseEntraAuthentication'], true) }}:
+            HelixUseEntraAuthentication: true
+            HelixAzureSubscription: ${{ variables.helixAzureSubscription }}
+            HelixBaseUri: ${{ variables.helixBaseUri }}
+          ${{ else }}:
+            HelixAccessToken: $(HelixApiAccessToken)
         HelixTargetQueues: ${{ join(' ', parameters.helixQueues) }}
         ${{ if ne(variables['System.TeamProject'], 'internal') }}:
           Creator: $(Creator)