Azure Dev Ops security architecture connecting to different tenancies/subscriptions

santoshpandey11 

If you need Azure DevOps to connect to the other subscription, you will need a Service Principal account.  This can be created from inside Azure DevOps if you are a user with owner access on the subscription to create a Service Principal or you can use an existing Service Principal account. https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-2.7.0

Once you have that account you can create a service connection in Azure DevOps for your project. This account can be used in your pipelines. You will need to pick the subscription during the creation of tasks so make sure you label the service connection so its easy to find.

https://docs.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml

One point to look at for is the access levels the service principal account has, It will need read access to the subscription but only contributure access to any resource groups if you want to lock it down.