TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Azure Pipelines Repository Access Control

12 posts · Feb 2013 – Apr 2026

What this trail covers

Azure Pipelines supports checking out multiple repositories, enabling users to fetch and check out additional repositories beyond the one storing the YAML pipeline. This simplifies scenarios where pipelines depend on multiple source, tool, or script repositories, eliminating the need for submodules or manual git checkout scripts. Additionally, GitHub Actions can now trigger Azure Pipelines runs using the Azure/pipelines action, allowing for integration of Azure Pipelines into GitHub Actions. This post fixes a null reference exception in the multi-repo trigger functionality when there are no resource repositories defined in the YAML pipeline.

All Microsoft trails
  1. Optimizing Git policy management at scaleIntroduced a new `refName=~all` parameter for the `GET /_apis/git/policy/configurations` REST API endpoint. This parameter, when used with `repositoryId`, allows for the efficient retrieval of all branch policies affecting any branch within a repository, as well as all push policies affecting the entire repository, including inherited policies. This change significantly reduces the overhead for enterprise policy management services by eliminating the need for client-side filtering of policies, leading to a 2x reduction in CPU usage and a 10-15x improvement in execution time for policy management operations.
  2. Azure Developer CLI: From Dev to Prod with Azure DevOps PipelinesThis post demonstrates implementing a "build once, deploy everywhere" pattern using Azure Developer CLI (azd) with Azure DevOps YAML pipelines. It details a multi-stage pipeline structure for build, development deployment, and production promotion, emphasizing the use of pipeline artifacts for managing build outputs across stages. The post also includes a placeholder for a validation gate before production deployment and discusses environment-specific variable configuration for production. It references a previous GitHub Actions implementation and highlights the advantages of using native CI/CD artifact systems over local file backups.
  3. July Patches for Azure DevOps ServerThis patch fixes a null reference exception in the multi-repo trigger functionality for Azure DevOps Server 2020.1.2 when no resource repositories are defined in the YAML pipeline.
  4. Azure Pipeline: Error: Cannot read properties of undefined (reading 'templatePath').This post addresses a specific error ('Error: Cannot read properties of undefined (reading 'templatePath')') encountered when editing Azure DevOps YAML pipelines connected to external repositories (e.g., Bitbucket) where the associated service connection has been deleted. It provides two workarounds: 1. Using Azure DevOps REST APIs to retrieve the pipeline's JSON body, update the `connectedServiceId` with a valid service connection's resource ID, and then update the pipeline. 2. Editing a working YAML pipeline, accessing its classic editor via the 'Triggers' option, and then modifying the service connection for the non-working pipeline using the URL structure.
  5. Limit user visibility and collaboration to specific projectsThis post introduces a public preview feature for Azure DevOps organizations that allows administrators to restrict user visibility and collaboration to specific projects. When enabled, users and groups added to the 'Project-Scoped Users' group will have limited access to Organization Settings (only Overview and Projects) and will only be able to search for, view, select, and tag members within the projects they are currently in. The post notes that these restrictions are currently UI-only and do not affect REST API access.
  7. Static Web App PR Workflow for Azure App Service Using Azure DevOpsThis post describes how to implement a dynamic pull request workflow for Azure App Service applications using Azure DevOps. It details the configuration of Azure Pipelines to automatically provision a unique deployment slot for each pull request, deploy the application to that slot, and comment the staging URL back to the pull request. This replicates the out-of-the-box PR workflow provided by Azure Static Web Apps for applications hosted on Azure App Service.
  8. Let's Hack a Pipeline: Shared InfrastructureThis post details the risks associated with shared infrastructure for pipelines, where compromising one pipeline can lead to the compromise of all pipelines using the same agent pool. It recommends using one-time use agents (Microsoft-hosted or scale set agents) and running self-hosted agents with minimal privileges as mitigation strategies. It also highlights that project-level isolation is a more appropriate middle ground than sharing pools across projects.
  9. Let's Hack a Pipeline: Stealing Another RepoDetails an attack vector where a malicious user can leverage pipeline definitions to clone and push code from unauthorized repositories using the build service identity's elevated privileges. Explains the history of build service identity scoping and the power of editing pipeline definitions. Introduces two mitigation strategies: 'Limit job authorization scope' to project level and explicitly defining repository access in the 'resources' section of the pipeline, requiring one-time authorization for new repositories.
  10. Introducing the New Pull Request Experience for Azure ReposThis post details the technical enhancements to the Azure Repos pull request experience. It introduces a rollup view for policy completion, allowing users to quickly assess the status of required checks. The ability to add specific required reviewers per pull request is now available, alongside the option to make existing optional reviewers required. File review is improved with multiple iteration selection. A significant new feature is the 'suggested changes' capability, allowing reviewers to propose edits that the pull request author can accept and commit directly within the PR interface. Auto-complete now supports waiting on optional policies. The creation page includes a separate tab for changes preview and warnings for large target branch selections. Direct links to policies are provided for reviewers, and team membership is now viewable directly from the reviewer section. Performance gains are quantified with Apdex scores and load time deltas.
  11. What’s new in Azure DevOps Sprint 161Introduced the ability to fetch and check out multiple repositories in Azure Pipelines, allowing users to include additional repositories beyond the primary YAML pipeline repository. This addresses the previous limitation of needing submodules or manual git checkout scripts. Also added GitHub Actions support for triggering Azure Pipelines runs via the Azure/pipelines action, enabling integration of Azure Pipelines into GitHub Actions workflows. Enhanced the Azure Pipelines app for Slack and Microsoft Teams with bulk subscription capabilities for all pipelines in a project, including filtering.
  12. Announcing Kubernetes integration for Azure PipelinesThis post introduces Kubernetes integration for Azure Pipelines, enabling automated CI/CD pipeline and Kubernetes manifest generation for deployments to Azure Kubernetes Service (AKS) and other Kubernetes clusters. It details a four-step process for setting up pipelines by scanning Git repositories and suggesting YAML templates. A new 'Deploy Kubernetes manifests' task is introduced to simplify deployments by handling artifact substitution, metadata annotation, manifest stability checks, and secret management. The post also highlights hybrid and multi-cloud support for Kubernetes features.
  13. Automating Releases in GitHub through Azure PipelinesIntroduced the GitHub Release task for Azure Pipelines, enabling automation of GitHub Release creation, editing, and deletion. This task can upload build artifacts as release assets and automatically compile changelogs by comparing commit history between releases. It supports conditional execution based on tag patterns and can be integrated with approvals for draft releases.
  14. Run your CI with Jenkins and CD with Azure DevOpsThis post details how to integrate Jenkins as a CI system with Azure DevOps Release for CD. It outlines the steps for configuring Jenkins with the Team Foundation Server plugin to trigger Azure DevOps releases and configuring Azure DevOps to consume Jenkins jobs as artifact sources, enabling end-to-end traceability, tracking commits and work-items, manual approvals and deployment gates, and deployment to various services via Azure pipelines.
  15. Amazon AWS and new NDepend pricing plans in August's VSTS extension round-upThis post announces the release of AWS Tools for Microsoft Visual Studio Team Services, an extension providing build and release tasks for interacting with AWS services. It details specific tasks like AWS CloudFormation Create/Update Stack, AWS Elastic Beanstalk Deployment, AWS Lambda .NET Core Deployment, AWS S3 Download/Upload, and AWS CLI execution. It also highlights NDepend's new pricing plans for its static analysis tools, making it more accessible to customers.
  16. Deploying Applications to Azure Virtual Machine Scale SetsThis post introduces the 'Build immutable machine image' task for Azure Pipelines, which uses Packer to create custom VM images (VHDs) for Azure Virtual Machine Scale Sets. It details the process of building a Node.js application with NGINX and PM2, creating an Ubuntu 16.04 VHD image, and then updating a VM Scale Set with this new image using an Azure PowerShell script. The post also outlines the build steps (npm install, Gulp, npm test, Publish Build Artifacts) and release steps (Bake Immutable image for VMSS, Azure PowerShell) required for this immutable deployment strategy.
  17. Get started with some basic TFBuild scriptsThis post introduces the ability to run custom scripts (batch or PowerShell) as part of the TFBuild process, allowing for pre-build assembly versioning and post-build binary staging. It details how to leverage environment variables and provides example scripts for these tasks. It also references existing documentation on build process customization and environment variables available to scripts.
  18. Run CI builds in your Git team projectThis post details how to define a Continuous Integration (CI) build process for Git team projects in Visual Studio Team Foundation Service. It covers connecting to a Git team project, defining the build process by specifying triggered branches and the solution to build, and how to initiate and monitor builds after code commits. It also addresses common questions regarding test runs, build process template customization, triggered branches, retention policies, default branches, and work item association with builds.