Basics Lesson 1 of 16

What is Azure DevOps?

A unified platform by Microsoft that brings together tools for planning, developing, delivering, and operating software at scale.

🧒 Simple Explanation (ELI5)

Imagine you're building a house. You don't just show up with a hammer — you need a blueprint (what to build), a lumber yard (where materials are stored), a construction crew (who follows the plan step by step), a warehouse (where finished parts are kept until needed), and an inspector (who verifies everything is safe before anyone moves in).

Azure DevOps is all five of those things in one place:

Without Azure DevOps? You'd need a separate tool for each job — Jira for tasks, GitHub for code, Jenkins for builds, Nexus for packages, and a spreadsheet for test cases. That's five logins, five dashboards, five sets of permissions, and zero integration between them. Azure DevOps puts it all under one roof with a single identity, single permissions model, and native integration between every service.

💡
Fun Fact

Microsoft uses Azure DevOps internally to build Azure DevOps itself — hundreds of engineers, thousands of daily CI builds, and multiple production deployments per day. It's a real-world, battle-tested platform at extreme scale.

🔧 Technical Explanation

The Five Core Services

Azure DevOps is a suite of five integrated services offered as a cloud-hosted SaaS platform (dev.azure.com) or as a self-hosted server product (Azure DevOps Server, formerly TFS). Each service can be used independently or together.

1. Azure Boards

A work-tracking system that supports Agile, Scrum, and CMMI process templates out of the box. It provides:

2. Azure Repos

Enterprise-grade Git repositories with full support for branching, pull requests, and code review. Key features:

3. Azure Pipelines

The CI/CD engine — arguably the most powerful service in the suite. It supports building, testing, and deploying code to any platform:

4. Azure Artifacts

A fully integrated package management solution supporting multiple feed types:

5. Azure Test Plans

A manual and exploratory testing tool designed for QA teams:

💡
Tip

You can enable or disable each service independently per project. If your team only needs Repos and Pipelines, turn off Boards, Artifacts, and Test Plans to keep the interface clean. Go to Project Settings → General → Overview to toggle services.

Organizations, Projects, and Teams

Azure DevOps uses a three-level hierarchy for organizing work:

LevelWhat It IsExample
OrganizationThe top-level container. Tied to your Azure AD tenant (or Microsoft account). Contains all projects, users, billing, and policies.dev.azure.com/contoso
ProjectA logical boundary for a product or team. Contains repos, pipelines, boards, artifacts, and test plans. Can be public or private.contoso/WebApp, contoso/MobileApp
TeamA subset of people within a project. Each team gets its own board, backlog, sprint cadence, and capacity settings. A project can have many teams.WebApp\Frontend-Team, WebApp\Backend-Team
Important

The organization URL matters — it's the identity boundary. Users, billing, audit logs, and security policies are all scoped to the organization. Most companies create one organization per company (e.g., dev.azure.com/contoso) and multiple projects within it. Don't create separate organizations for each team — that breaks cross-project visibility and shared resources.

Azure DevOps Cloud vs. Azure DevOps Server

AspectAzure DevOps Services (Cloud)Azure DevOps Server (On-Prem)
HostingSaaS — Microsoft manages all infrastructureSelf-hosted on your servers or VMs
URLdev.azure.com/{org}https://yourserver/tfs
UpdatesContinuous — new features every 2–3 weeksMajor releases every ~6 months, you control upgrade timing
AuthenticationAzure AD, Microsoft Account, GitHubActive Directory (on-prem AD)
ScalabilityMicrosoft handles scaling — works for 1 to 100,000 usersYou manage capacity, backups, and HA
Data ResidencyChoose region at org creation (US, EU, Australia, etc.)Data stays on your servers — full control
Best ForMost teams — zero maintenance, always up-to-dateRegulated industries requiring on-prem data, air-gapped networks
💡
Tip

Unless you have a strict regulatory or network isolation requirement, always choose Azure DevOps Services (cloud). It's easier to manage, always current, and the free tier is generous. Azure DevOps Server requires dedicated hardware, patching, and upgrade maintenance.

Brief History & Evolution

Azure DevOps has gone through several name changes, but the DNA is the same:

YearNameWhat Changed
2005Team Foundation Server (TFS) 2005Original on-prem ALM platform with version control (TFVC), work items, and builds
2013Visual Studio Online (VSO)Cloud-hosted version of TFS launched as a SaaS product
2015Visual Studio Team Services (VSTS)Rebranded. Git support became first-class. Build system modernized.
2018Azure DevOps Services / ServerFinal rebrand. Decomposed into 5 independent services. REST API-first. YAML pipelines introduced.
2020+GitHub Advanced Security for ADOSecret scanning, dependency scanning, and code scanning brought from GitHub into Azure DevOps repos

Understanding this history matters because you'll encounter legacy terminology in the wild — "TFS," "VSTS," and "Release Management" are all predecessors of current Azure DevOps features. If a job posting says "TFS experience," they're talking about the same platform.

Azure DevOps REST API

Everything in Azure DevOps is accessible via a comprehensive REST API. This is critical for automation, custom integrations, and tooling:

bash
# List all projects in your organization
curl -u :YOUR_PAT \
  "https://dev.azure.com/{org}/_apis/projects?api-version=7.1"

# Get all repositories in a project
curl -u :YOUR_PAT \
  "https://dev.azure.com/{org}/{project}/_apis/git/repositories?api-version=7.1"

# Queue a pipeline run
curl -X POST -u :YOUR_PAT \
  -H "Content-Type: application/json" \
  -d '{"definition":{"id":1}}' \
  "https://dev.azure.com/{org}/{project}/_apis/build/builds?api-version=7.1"

The API uses Personal Access Tokens (PATs) for authentication and follows the pattern: https://dev.azure.com/{org}/{project}/_apis/{area}/{resource}?api-version=7.1. There are also official client libraries for .NET, Python, Node.js, and Java.

📊 Azure DevOps Platform Overview

The 5 Azure DevOps Services — How They Connect
Plan
Azure Boards
Epics → Stories → Tasks
Sprints & Kanban
Develop
Azure Repos
Git Repositories
PRs & Branch Policies
Build & Test
Azure Pipelines
CI/CD — YAML or Classic
Multi-stage, Multi-platform
Package
Azure Artifacts
NuGet, npm, Maven, pip
Upstream Proxying
Verify
Azure Test Plans
Manual & Exploratory
Automated Results
Organization → Project → Team Hierarchy
Organization
dev.azure.com/contoso
Projects
WebApp
MobileApp
InfraAsCode
Teams (within WebApp)
Frontend Team
Backend Team
DevOps Team

📊 Azure DevOps vs. GitHub vs. Jenkins vs. GitLab

Azure DevOps isn't the only DevOps platform, but it occupies a unique position — especially for Microsoft-ecosystem teams. Here's an honest comparison:

FeatureAzure DevOpsGitHubJenkinsGitLab
Source ControlAzure Repos (Git + TFVC)GitHub Repos (Git)None (integrates via plugins)GitLab Repos (Git)
CI/CDAzure Pipelines (YAML & Classic)GitHub Actions (YAML)Jenkinsfile (Groovy)GitLab CI (.gitlab-ci.yml)
Work TrackingAzure Boards (Agile, Scrum, CMMI)GitHub Issues & ProjectsNone — use Jira/TrelloGitLab Issues & Boards
Package MgmtAzure Artifacts (NuGet, npm, Maven, pip)GitHub PackagesNone — use Nexus/ArtifactoryGitLab Package Registry
Test MgmtAzure Test Plans (manual + exploratory)No built-in test managementTest reports via pluginsNo built-in test management
HostingCloud + On-prem (Server)Cloud + GHES (Enterprise Server)Self-hosted onlyCloud + Self-managed
PricingFree for ≤5 users; Basic $6/user/moFree tier; Team $4/user/moFree (open source); infra costsFree tier; Premium $29/user/mo
Marketplace~1,500 extensions20,000+ Actions1,800+ plugins~500 integrations
Best ForEnterprise .NET/Azure shops, regulated industriesOpen source, startups, GitHub-native teamsMaximum customization, legacy orgsAll-in-one DevOps platform
Azure IntegrationNative — first-class ARM/Bicep, AKS, ACR, Key VaultGood via Actions (azure/login)Via plugins — more setup neededVia CI variables — manual config
⚠️
Note

Microsoft owns both Azure DevOps and GitHub. They are separate products with different architectures and roadmaps. Microsoft has stated that both will continue to be supported. Azure DevOps excels at enterprise governance, compliance, and deep Azure integration. GitHub excels at open-source collaboration, developer experience, and ecosystem size. Many large organizations use both — GitHub for source code and Actions, Azure DevOps for Boards and advanced pipeline orchestration.

Azure DevOps vs GitHub Actions — Practical Decision Guide

The earlier comparison table is broad. For day-to-day engineering decisions, most teams are really choosing between Azure Pipelines and GitHub Actions. The best choice depends on whether your center of gravity is enterprise governance or GitHub-native developer workflow.

QuestionAzure DevOpsGitHub Actions
Where does work planning live?Strong built-in Boards with epics, sprints, queries, and dashboards.Issues and Projects are simpler and more repo-centric.
How mature are release controls?Very strong environment approvals, checks, Classic legacy support, and enterprise governance.Good environment protections, but generally simpler and more workflow-oriented.
Where is the source-control center of gravity?Azure Repos or mixed enterprise tooling.GitHub repos and pull-request workflow.
How deep is Azure platform integration?Native Azure service connections, AKS, ACR, Key Vault, and enterprise identity patterns.Strong Azure support through Actions, but often with more explicit workflow assembly.
What about marketplace ecosystem?Smaller but solid task ecosystem.Larger action ecosystem and faster community adoption.
What teams usually prefer it?Large enterprises, regulated teams, Microsoft-heavy estates.Developer-led teams, open-source-heavy orgs, GitHub-native platforms.

Choose Azure DevOps When

Choose GitHub Actions When

Use Both When

💡
Simple Interview Answer

Azure DevOps is usually stronger for integrated enterprise planning and governed delivery. GitHub Actions is usually stronger for GitHub-native developer workflow and ecosystem breadth. Neither is universally better; the right answer depends on where the team already lives and how much governance the release process needs.

🛠️ Hands-on: Create Your First Organization, Project & Repo

Let's walk through setting up Azure DevOps from scratch — entirely through the web UI. You'll have a working org, project, and repo in under 10 minutes.

Prerequisites

Step 1: Create an Organization

  1. Navigate to https://dev.azure.com and sign in with your Microsoft account.
  2. If this is your first time, you'll be prompted to create an organization. Choose a name (e.g., yourname-learning). This becomes your URL: dev.azure.com/yourname-learning.
  3. Select your region — this determines where your data is stored. Choose the region closest to you. This cannot be changed later.
  4. Click "Continue". Your organization is created.
💡
Tip

Organization names must be globally unique across all of Azure DevOps. If "contoso" is taken, try "contoso-dev" or "contoso-2024". Keep it short — you'll type this URL often.

Step 2: Create a Project

  1. After creating the org, you're prompted to create your first project.
  2. Enter a Project name: MyFirstProject
  3. Set Visibility to Private (default — only invited users can see it).
  4. Under Advanced, select:
    • Version control: Git (always choose Git for new projects)
    • Work item process: Agile (best for most teams; Scrum and CMMI are also available)
  5. Click "Create project".

Step 3: Explore the Project

Once the project is created, you'll land on the project home page. Notice the left sidebar — it shows all five services:

text
📋 Overview         → Project summary, dashboards, wiki
📋 Boards           → Work items, sprints, backlogs
🔀 Repos            → Git repositories, branches, PRs
🚀 Pipelines        → CI/CD pipeline definitions and runs
📦 Artifacts        → Package feeds (NuGet, npm, etc.)
🧪 Test Plans       → Manual testing (requires Basic + Test Plans license)

Step 4: Create Your First Repository

  1. Click Repos in the left sidebar. You'll see an empty default repo with the same name as your project.
  2. Click "Initialize" to create the repo with a default README and .gitignore. Choose a template (e.g., VisualStudio) for the .gitignore.
  3. The repo is created with an initial commit. You now have a working Git repository.

Step 5: Clone the Repo Locally

Click the "Clone" button in the top right of the Repos page. Copy the HTTPS URL:

bash
# Clone using HTTPS (you'll be prompted for credentials)
git clone https://dev.azure.com/yourname-learning/MyFirstProject/_git/MyFirstProject

# Navigate into the repo
cd MyFirstProject

# Create a file, commit, and push
echo "Hello Azure DevOps" > hello.txt
git add hello.txt
git commit -m "feat: add hello world file"
git push origin main
💡
Tip

When cloning via HTTPS, use a Personal Access Token (PAT) as your password — not your Microsoft account password. Generate a PAT from User Settings → Personal Access Tokens in the Azure DevOps web UI. Give it Code (Read & Write) scope and set an expiration date.

Step 6: Verify in the Web UI

Go back to Repos → Files in the browser. You'll see your hello.txt file with the commit message. Click Commits to see the history. Click Branches to see the main branch. You've just completed the full loop: create org → create project → clone → push → verify.

Step 7: Create a Personal Access Token (PAT)

PATs are your programmatic password for Azure DevOps. You'll need one for Git credential authentication and API access:

  1. Click your profile icon (top right) → Personal Access Tokens.
  2. Click "+ New Token".
  3. Configure the PAT:
    • Name: Git-access (descriptive name for what it's used for)
    • Organization: Select your org (or "All accessible organizations" for cross-org use)
    • Expiration: Choose a reasonable duration (30, 60, or 90 days). Avoid "custom" with 1-year expiry for security.
    • Scopes: Select only what you need. For basic Git access: Code → Read & Write. For pipeline automation: also add Build → Read & Execute.
  4. Click Create. Copy the token immediately — it won't be shown again.
⚠️
Security Warning

Treat PATs like passwords — never commit them to code, never share them in chat, never store them in plain text. Use a password manager or your OS credential manager. PATs grant access equivalent to your user account within the scopes you selected. If a PAT leaks, revoke it immediately from the same Personal Access Tokens page.

🐛 Debugging Scenarios

Scenario 1: "Cannot Create Project"

Symptom: You click "New Project" but get an error: "You do not have permission to create a project" or the button is grayed out.

Root Causes & Fixes:

text
# Check your access level:
# Organization Settings → Users → find your name → check "Access Level"
# Must be "Basic" or higher to create projects

# Check your group membership:
# Organization Settings → Permissions → Project Collection Administrators
# Your name must be listed (directly or through a group)

Scenario 2: "Pipeline Not Triggering"

Symptom: You push code but no pipeline runs. The Pipelines page shows no new runs.

Root Causes & Fixes:

yaml
# Ensure your YAML has a proper trigger section:
trigger:
  branches:
    include:
      - main
      - feature/*
  paths:
    exclude:
      - '*.md'
      - docs/**

# If you want ALL branches to trigger:
trigger:
  - '*'

Scenario 3: "Cannot See Repos"

Symptom: You navigate to Repos in the sidebar, but it says "You don't have access" or the section is missing entirely.

Root Causes & Fixes:

⚠️
Common Pitfall

Stakeholder access is free and unlimited in Azure DevOps Services, but it only gives access to Boards and limited Pipelines visibility. Developers need Basic access ($6/user/month) to use Repos, full Pipelines, and Artifacts. The first 5 Basic users are free.

Scenario 4: "Clone Fails with 'Authentication Failed'"

Symptom: Running git clone https://dev.azure.com/... returns fatal: Authentication failed.

Root Causes & Fixes:

bash
# On Windows — clear cached Git credentials
git credential-manager reject https://dev.azure.com

# On macOS — remove from Keychain
git credential-osxkeychain erase <<EOF
host=dev.azure.com
protocol=https
EOF

# Then re-clone — you'll be prompted for credentials
git clone https://dev.azure.com/{org}/{project}/_git/{repo}

🎯 Interview Questions

Beginner

Q: What is Azure DevOps and what are its five core services?

Azure DevOps is a Microsoft SaaS platform (also available on-prem as Azure DevOps Server) that provides an integrated set of tools for the entire software development lifecycle. The five core services are: 1. Azure Boards — work tracking with Kanban boards, sprints, backlogs, and dashboards. 2. Azure Repos — Git-based source control with branch policies and pull request workflows. 3. Azure Pipelines — CI/CD engine supporting YAML and classic (GUI) pipelines, running on Microsoft-hosted or self-hosted agents. 4. Azure Artifacts — package management for NuGet, npm, Maven, Python (pip), and Universal Packages with upstream proxying. 5. Azure Test Plans — manual, exploratory, and automated test management with browser-based test runners. Each service can be enabled or disabled independently per project.

Q: What is the difference between Azure DevOps Services (cloud) and Azure DevOps Server?

Azure DevOps Services is the SaaS offering hosted by Microsoft at dev.azure.com. Microsoft manages all infrastructure, scaling, backups, and updates — new features ship every 2–3 weeks. Authentication is via Azure AD or Microsoft accounts. Azure DevOps Server is the on-premises version you install on your own servers. You control updates, data residency, and network access. It uses on-prem Active Directory for authentication. Choose Services (cloud) for most teams — it's zero-maintenance and always current. Choose Server for regulated industries that require data to stay on-premises or for air-gapped (disconnected) environments.

Q: What is an Organization in Azure DevOps and how does it relate to Projects and Teams?

The hierarchy is Organization → Project → Team. An Organization is the top-level container — it holds all projects, users, billing, and org-wide policies. It maps to dev.azure.com/{orgname} and is typically one per company, backed by an Azure AD tenant. A Project is a logical boundary within an org — it contains repos, pipelines, boards, artifacts, and test plans for a product or team. Projects can be public or private. A Team is a subgroup within a project — each team gets its own board view, backlog, sprint cadence, and capacity tracking. A single project can have many teams (e.g., Frontend, Backend, QA).

Q: What access levels exist in Azure DevOps and what can each do?

Azure DevOps has three access levels: 1. Stakeholder (free, unlimited users): Can use Boards (view/edit work items, backlogs, Kanban), view pipeline runs, but cannot access Repos, create pipelines, or use Artifacts. Designed for managers and business stakeholders. 2. Basic ($6/user/month, first 5 free): Full access to Boards, Repos, Pipelines, and Artifacts. This is what developers need. 3. Basic + Test Plans ($52/user/month): Everything in Basic plus full Azure Test Plans features — creating test plans, running manual tests, and exploratory testing. Typically for QA engineers. The free tier gives you 5 Basic users at no cost, making it free for small teams.

Q: Can you use Azure DevOps with non-Microsoft technologies?

Yes — Azure DevOps is platform-agnostic despite being a Microsoft product. Azure Repos stores any code (Java, Python, Go, Rust — it's just Git). Azure Pipelines runs on Ubuntu, macOS, and Windows agents and can build any language — it ships with built-in tasks for Java (Maven, Gradle), Node.js (npm), Python (pip), Go, Ruby, PHP, Docker, Kubernetes, and more. Azure Artifacts supports npm, Maven, pip, and NuGet (not just .NET). Deployment targets include Kubernetes (any provider), AWS, GCP, SSH endpoints, and any Docker registry. Azure DevOps works for Java+Kubernetes teams just as well as for .NET+Azure teams.

Intermediate

Q: How do Azure Pipelines YAML pipelines differ from Classic pipelines? Which should you use?

YAML Pipelines: Defined in code (azure-pipelines.yml), version-controlled in your repo, reviewed in PRs, support templates and reuse, and are the recommended approach for all new projects. They support multi-stage deployments with environment approvals. Classic Pipelines: Built via a GUI drag-and-drop editor in the web portal. Easier for beginners but not version-controlled (stored in the service, not in Git), harder to review, share, or replicate across projects. Recommendation: Always use YAML for new projects. Classic pipelines are still supported but Microsoft is investing all new features in YAML. Classic is useful for quick prototyping or teams transitioning from TFS, but you should migrate to YAML as soon as possible.

Q: What are Service Connections and why are they important?

Service Connections are secure, reusable authentication configurations that allow Azure Pipelines to connect to external services: Azure subscriptions, Kubernetes clusters, Docker registries, GitHub repos, SSH endpoints, npm feeds, and more. They're important because: 1. Security — credentials are stored securely in Azure DevOps, not in pipeline YAML or code. 2. Least privilege — each connection can be scoped to specific pipelines and require approval before use. 3. Federated credentials (OIDC) — for Azure connections, you can use workload identity federation (no secrets at all). 4. Reusability — define once, use in many pipelines. Create them in Project Settings → Service Connections. In interviews, emphasize that you should use workload identity federation for Azure connections instead of service principal secrets.

Q: How does Azure DevOps integrate with Azure Active Directory (Entra ID)?

Azure DevOps organizations can be backed by an Azure AD (now Entra ID) tenant, which provides: 1. Single Sign-On (SSO) — users log in once with their corporate identity, no separate Azure DevOps credentials. 2. Conditional Access — enforce MFA, compliant devices, IP restrictions, and session policies for Azure DevOps access. 3. Group-based licensing — assign Basic or Basic+Test Plans access to AD security groups; users inherit access level automatically. 4. Guest access — invite external users (contractors, partners) via Azure AD B2B — they get scoped access without separate accounts. 5. Audit logs — all sign-ins and permission changes flow to Azure AD audit logs for compliance. Connecting to Azure AD is configured in Organization Settings → Azure Active Directory.

Q: What are Azure DevOps Extensions and how do they work?

Extensions are add-ons that extend Azure DevOps functionality, published on the Visual Studio Marketplace. They can add: new pipeline tasks (e.g., SonarQube analysis, Terraform deployment), custom dashboard widgets, work item form controls, new hub pages, and service hooks. Extensions are installed at the organization level by collection administrators and can be scoped to specific projects. Popular extensions include: SonarQube/SonarCloud (code quality), WhiteSource/Mend (dependency scanning), Terraform (IaC tasks), Replace Tokens (variable substitution), and GitLeaks (secret scanning). You can also build custom extensions using the Azure DevOps Extension SDK (TypeScript-based). There are ~1,500 extensions available, both free and paid.

Q: How do you manage security and permissions in Azure DevOps?

Azure DevOps uses a layered security model: 1. Organization level: Organization settings, policies (disable SSH auth, enforce Azure AD), Project Collection Administrators/Valid Users groups. 2. Project level: Project Administrators, Contributors, Readers groups — each with predefined permissions for repos, pipelines, boards. 3. Object level: Fine-grained permissions on individual repos, branches, pipelines, and build definitions. For example, you can allow Team A to push to repo-frontend but not repo-backend. 4. Branch policies: Require reviewers, linked work items, and successful builds before merging to protected branches. Best practices: Use Azure AD groups for permission assignment (not individual users), follow least-privilege, limit Project Collection Administrators, and audit permissions regularly.

Scenario-Based

Q: Your company is migrating from Jenkins to Azure DevOps. You have 200+ Jenkinsfiles. How would you plan this migration?

A phased approach over 3–6 months: Phase 1 — Assessment (2 weeks): Inventory all 200+ Jenkinsfiles. Categorize by complexity (simple CI, multi-branch, deployment pipelines) and priority (active vs. legacy). Identify Jenkins plugins used and their Azure DevOps equivalents. Phase 2 — Foundation (2 weeks): Set up the Azure DevOps organization, projects, and service connections. Establish naming conventions, security groups, and branch policies. Create pipeline templates for common patterns (build .NET, build Node, deploy to AKS). Phase 3 — Migrate in waves (2–4 months): Start with simple CI pipelines (easiest win). Use pipeline templates so each migration is mostly filling in parameters. Migrate 10–20 pipelines per sprint, test thoroughly, and decommission Jenkins jobs as they go. Phase 4 — Advanced + Cutover (2 weeks): Migrate complex multi-branch and deployment pipelines last. Shut down Jenkins server. Key tools: Microsoft provides a Jenkins to Azure Pipelines migrator extension for basic conversions. For Groovy shared libraries, rewrite as YAML templates.

Q: A team lead says "We have 8 microservices and 3 teams. Should we use one Azure DevOps project or multiple?" What do you recommend?

One project with multiple repos and teams is the recommended approach for most organizations. Here's why: Single project benefits: Shared backlog visibility across teams, cross-repo pipelines (service A can trigger service B's pipeline), shared dashboards and queries, unified permission management, single set of service connections. Create one repo per microservice (svc-auth, svc-orders, svc-payments, etc.) and one team per actual team. Each team gets its own board, backlog, and sprint cadence within the same project. When to use multiple projects: Only if teams need complete isolation (different security boundaries, different compliance requirements, separate billing). For example, a "Public Website" project vs. a "Payment Processing" project with strict PCI-DSS isolation. The overhead of managing cross-project dependencies (shared artifacts, cross-project queries) makes multiple projects harder to govern.

Q: A developer accidentally pushed a secret (API key) to an Azure Repos repository. How do you handle this?

Immediate response (within minutes): 1. Rotate the secret — generate a new API key in the service that issued it and revoke the old one. This is the most critical step — removing the commit from Git history does NOT protect you because the secret was already exposed (cloned, cached, or indexed). 2. Remove from Git history — use git filter-repo or BFG Repo Cleaner to purge the commit from all branches. Force-push the cleaned history. 3. Notify the team — tell all developers to re-clone the repo (their local history still has the secret). Prevention for the future: Enable Credential Scanner (CredScan) task in CI pipelines. Add .gitignore rules for common secret file patterns. Use Azure Key Vault for secrets with pipeline integration via the AzureKeyVault@2 task. Enable push policies that block commits containing known secret patterns. Configure GitHub Advanced Security for Azure DevOps (GHAzDO) for real-time secret scanning on push.

Q: Your Azure Pipeline takes 45 minutes to run. The team complains about slow feedback. How do you speed it up?

Systematic optimization approach: 1. Analyze the timeline — open the pipeline run, switch to the Timeline view, and identify which stages/jobs/steps take the longest. 2. Enable caching — use the Cache@2 task to cache NuGet packages, npm node_modules, pip packages, and build outputs. This alone can cut 5–15 minutes. 3. Parallelize — split independent tasks into parallel jobs. For example, run unit tests and integration tests in separate jobs. Use matrix strategies to test multiple platforms simultaneously. 4. Use incremental builds — only build and test what changed. Use path triggers so services only rebuild when their directory changes. 5. Optimize Docker builds — use multi-stage Dockerfiles, order layers by change frequency (dependencies first), and push to ACR with layer caching enabled. 6. Self-hosted agents — Microsoft-hosted agents start cold every run. Self-hosted agents retain caches, Docker layers, and tools between runs — often 2–3x faster. 7. Remove unnecessary steps — audit every task. Remove deprecated steps, redundant installs, and verbose logging in production pipelines.

Q: You need to set up Azure DevOps for a financial services company with strict compliance requirements (SOC 2, ISO 27001). What would you configure?

Organization level: Back the org with Azure AD (Entra ID) and enforce Conditional Access policies — require MFA, compliant devices, and restrict by IP range. Disable alternate authentication (SSH keys, PATs) or set maximum PAT lifetimes. Enable the Auditing feature to stream all events to Azure Monitor or Splunk. Project level: Set all projects to Private. Restrict project creation to admins only. Repos: Enable branch policies — require 2 reviewers, linked work items, successful CI, and comment resolution before merge. Disable force-push and branch deletion on main/release branches. Enable GitHub Advanced Security for Azure DevOps (secret scanning, dependency scanning, code scanning). Pipelines: Use Environments with required approvals and business-hours checks. Enforce pipeline permissions — only approved pipelines can access production service connections. Require templates from a central repo for governance. Artifacts: Use upstream sources with allow-listing only approved public packages. Set retention policies for builds and releases (7-year retention for audit). All of these controls map directly to SOC 2 trust criteria and ISO 27001 Annex A controls.

🌍 Real-World Use Case

Azure DevOps Pricing Quick Reference

Before diving into a real scenario, here's the pricing you'll need to justify Azure DevOps adoption:

Service / FeatureFree TierPaid Tier
Basic AccessFirst 5 users free$6 per user/month
Basic + Test Plans$52 per user/month
Stakeholder AccessUnlimited users, free
Azure Pipelines (MS-hosted)1 parallel job, 1,800 min/month$40 per parallel job/month
Azure Pipelines (Self-hosted)1 parallel job (unlimited min)$15 per parallel job/month
Azure Artifacts2 GB free$2 per additional GB/month

For a team of 10 developers, the total cost is roughly $30/month (5 free Basic + 5 × $6). That's less than a single Jenkins server's compute cost on any cloud provider — and you get zero maintenance overhead.

E-Commerce Platform Migration to Azure DevOps

Consider a mid-size e-commerce company with 5 development teams (40 developers), using a mix of Jira, Bitbucket, Jenkins, and Nexus. Their pain points: tools are disconnected, developers context-switch between 5 dashboards, Jenkins maintenance consumes 20% of one engineer's time, and there's no unified audit trail for compliance.

What they adopted:

Results after 6 months:

💡
Key Takeaway

The biggest value of Azure DevOps isn't any single service — it's the integration between services. When Boards, Repos, Pipelines, and Artifacts all live in one platform, you get end-to-end traceability for free: a user story links to a PR, the PR triggers a pipeline, the pipeline publishes an artifact, and the artifact deploys to an environment with an approval gate. No plugin configuration, no webhook glue, no cross-tool authentication headaches.

📝 Summary

ConceptKey Takeaway
Azure DevOpsA Microsoft SaaS platform (also available on-prem) with 5 integrated services covering the full SDLC.
Azure BoardsWork tracking — Kanban, Scrum sprints, backlogs, dashboards. Supports Agile, Scrum, and CMMI processes.
Azure ReposGit repositories with branch policies, PR workflows, and code search. Also supports TFVC for legacy.
Azure PipelinesCI/CD engine — YAML or Classic. Runs on Microsoft-hosted or self-hosted agents. Multi-platform (Linux, Windows, macOS).
Azure ArtifactsPackage management for NuGet, npm, Maven, pip, and Universal Packages. Upstream proxying for reliability.
Azure Test PlansManual, exploratory, and automated test management. Test & Feedback browser extension for QA teams.
HierarchyOrganization → Project → Team. One org per company, projects per product/boundary, teams per group.
Access LevelsStakeholder (free, Boards only), Basic ($6/mo, full access), Basic + Test Plans ($52/mo). First 5 Basic users free.
Cloud vs. ServerUse Services (cloud) unless you have strict on-prem data requirements. Cloud gets updates every 2–3 weeks.
vs. GitHubBoth Microsoft-owned. Azure DevOps excels at enterprise governance; GitHub excels at OSS and developer experience. Many orgs use both.
← Back to Azure DevOps Course