diff --git a/docs/create-image-and-azure-resources.md b/docs/create-image-and-azure-resources.md
index 93838c2490..e8ce7ac30b 100644
--- a/docs/create-image-and-azure-resources.md
+++ b/docs/create-image-and-azure-resources.md
@@ -233,8 +233,9 @@ The following variables are required to be passed to the Packer process:
 | ------------ | ------- | -----------
 | `subscription_id` | `ARM_SUBSCRIPTION_ID` | The subscription under which the build will be performed.
 | `client_id` | `ARM_CLIENT_ID` | The Active Directory service principal associated with your builder.
-| `client_secret` | `ARM_CLIENT_SECRET` | The password or secret for your service principal; may be omitted if `client_cert_path` is set.
-| `client_cert_path` | `ARM_CLIENT_CERT_PATH` | The location of a PEM file containing a certificate and private key for the service principal; may be omitted if `client_secret` is set.
+| `client_secret` | `ARM_CLIENT_SECRET` | The password or secret for your service principal; may be omitted if `client_cert_path` or `client_jwt` is set.
+| `client_cert_path` | `ARM_CLIENT_CERT_PATH` | The location of a PEM file containing a certificate and private key for the service principal; may be omitted if `client_secret` or `client_jwt` is set.
+| `client_jwt` | `ARM_CLIENT_JWT` | A bearer JWT assertion for federated/workload identity authentication (e.g. Azure DevOps workload identity federation); may be omitted if `client_secret` or `client_cert_path` is set.
 | `location` | `ARM_RESOURCE_LOCATION` | The Azure datacenter in which your VM will be built.
 | `managed_image_resource_group_name` | `ARM_RESOURCE_GROUP` | The resource group under which the final artifact will be stored.
 
diff --git a/images/ubuntu/templates/source.ubuntu.pkr.hcl b/images/ubuntu/templates/source.ubuntu.pkr.hcl
index babc3cb5fe..941261077b 100644
--- a/images/ubuntu/templates/source.ubuntu.pkr.hcl
+++ b/images/ubuntu/templates/source.ubuntu.pkr.hcl
@@ -1,6 +1,7 @@
 source "azure-arm" "image" {
   client_cert_path                       = var.client_cert_path
   client_id                              = var.client_id
+  client_jwt                             = var.client_jwt
   client_secret                          = var.client_secret
   object_id                              = var.object_id
   oidc_request_token                     = var.oidc_request_token
diff --git a/images/ubuntu/templates/variable.ubuntu.pkr.hcl b/images/ubuntu/templates/variable.ubuntu.pkr.hcl
index 685c6604b6..399b16c251 100644
--- a/images/ubuntu/templates/variable.ubuntu.pkr.hcl
+++ b/images/ubuntu/templates/variable.ubuntu.pkr.hcl
@@ -7,6 +7,11 @@ variable "client_id" {
   type    = string
   default = "${env("ARM_CLIENT_ID")}"
 }
+variable "client_jwt" {
+  type      = string
+  default   = "${env("ARM_CLIENT_JWT")}"
+  sensitive = true
+}
 variable "client_secret" {
   type      = string
   default   = "${env("ARM_CLIENT_SECRET")}"
diff --git a/images/windows/templates/source.windows.pkr.hcl b/images/windows/templates/source.windows.pkr.hcl
index 8b407810dd..e460718154 100644
--- a/images/windows/templates/source.windows.pkr.hcl
+++ b/images/windows/templates/source.windows.pkr.hcl
@@ -1,6 +1,7 @@
 source "azure-arm" "image" {
   client_cert_path                       = var.client_cert_path
   client_id                              = var.client_id
+  client_jwt                             = var.client_jwt
   client_secret                          = var.client_secret
   object_id                              = var.object_id
   oidc_request_token                     = var.oidc_request_token
diff --git a/images/windows/templates/variable.windows.pkr.hcl b/images/windows/templates/variable.windows.pkr.hcl
index 1605ce4a57..5bd84380de 100644
--- a/images/windows/templates/variable.windows.pkr.hcl
+++ b/images/windows/templates/variable.windows.pkr.hcl
@@ -7,6 +7,11 @@ variable "client_id" {
   type    = string
   default = "${env("ARM_CLIENT_ID")}"
 }
+variable "client_jwt" {
+  type      = string
+  default   = "${env("ARM_CLIENT_JWT")}"
+  sensitive = true
+}
 variable "client_secret" {
   type      = string
   default   = "${env("ARM_CLIENT_SECRET")}"