ServiceEndpointProxy activity on ADO Service Connection

The official Azure DevOps documentation explains that Usage history records historical service-connection activity, but it does not document the internal ServiceEndpointProxy or ServicePrincipalSignInAudience labels. Therefore, that entry alone cannot prove a pipeline consumed the credential, and it is not enough evidence that deletion is safe. Search every YAML repository for both the service-connection name and ID, then inspect classic build and release definitions, pipeline permissions, approvals, checks, and recent runs. Also confirm ownership with the project administrators, because definitions in inactive branches or manually run pipelines may not appear in recent usage. During a maintenance window, remove the connection’s authorization from candidate pipelines and monitor for failures before deleting it. Export its configuration first, excluding secrets. If activity continues without any authorized pipeline, capture timestamps and open an Azure DevOps support case; Microsoft must identify that undocumented backend operation.

The “ServiceEndpointProxy” activity you are seeing in Azure DevOps (ADO) Service Connection logs is background authentication traffic generated by Azure DevOps itself to validate and refresh the service principal associated with the connection. It does not necessarily mean a pipeline is actively using the connection. Deleting the service connection will only impact pipelines or features that rely on that service principal for access.

https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints?view=azure-devops