ServiceEndpointProxy activity on ADO Service Connection

The official Azure DevOps documentation explains that Usage history records historical service-connection activity, but it does not document the internal ServiceEndpointProxy or ServicePrincipalSignInAudience labels. Therefore, that entry alone cannot prove a pipeline consumed the credential, and it is not enough evidence that deletion is safe. Search every YAML repository for both the service-connection name and ID, then inspect classic build and release definitions, pipeline permissions, approvals, checks, and recent runs. Also confirm ownership with the project administrators, because definitions in inactive branches or manually run pipelines may not appear in recent usage. During a maintenance window, remove the connection’s authorization from candidate pipelines and monitor for failures before deleting it. Export its configuration first, excluding secrets. If activity continues without any authorized pipeline, capture timestamps and open an Azure DevOps support case; Microsoft must identify that undocumented backend operation.