YAML Environment Checks and Deployment Approvals

Configure Pre-Deployment and Post-Deployment Gates in YAML

Integrating Service Connections and Environment Types

To secure and control deployments, Azure DevOps uses YAML pipelines to enforce gates and approvals. Before these pipelines can deploy resources, they require a service connection to authenticate with Azure. This connection is created under project settings using an Azure Resource Manager connection type, which typically relies on an Automatic Service Principal for secure communication.

Environments define where code is deployed and apply specific policies based on the environment type. Administrators define these environment types, such as Sandbox, FunctionApp, or WebApp, at the dev center level and reference them at the project level. Each environment is linked to specific Azure subscriptions, identities, and permissions to establish clear security boundaries.

Implementing Automated Gates and Checks

Pipelines use automated pre-deployment and post-deployment gates to validate the health and compliance of an application. These gates run inline scripts or execute tools within the pipeline steps to verify system status before moving to the next stage. For example, a pipeline might execute a script that checks a web endpoint's health state, failing the deployment if the response is not Healthy.

Managing Manual Approvals and Security Policies

Beyond automated checks, pipelines often require manual intervention to ensure organizational compliance. Teams can configure manual reviewers within the environment's checks and approval policies, halting the deployment until designated users sign off. This creates a control boundary where code cannot flow to sensitive environments without explicit, logged approval from authorized stakeholders.