Azure Pipelines Consulting

Problems we solve

• Classic pipelines (GUI-based) with no YAML source, changes are unreviewed and untracked
• Azure DevOps agents on outdated Windows VMs, no Linux support, no container builds
• No pipeline templates, every project team copy-pastes pipeline YAML
• Service connections with overly broad Azure permissions, pipelines can modify any resource
• No environment approvals, code deploys to production on any push to main

Our approach

1. 01

   Pipeline audit

   We inventory all Classic and YAML pipelines, service connections, agent pools, and variable groups. We identify security gaps and optimisation opportunities.

2. 02

   YAML migration

   Classic pipelines are converted to multi-stage YAML pipelines. We use the Azure Pipelines YAML schema with stage, job, and step hierarchies to enforce consistent structure.

3. 03

   Template library

   Shared pipeline logic is extracted into a template repository. Teams reference templates by version, giving central control over common patterns (build, test, push, deploy).

4. 04

   Agent infrastructure

   Self-hosted agents are deployed on AKS using KEDA-based autoscaling. Agents can scale to zero when idle and are provisioned on demand.

5. 05

   Security and governance

   Service connections are scoped to specific subscriptions and resource groups. Environment approval gates require named approvers for production deployments. Pipeline secrets are fetched from Azure Key Vault at runtime.

Results