50 Azure DevOps Interview Questions (With Answers)

Azure DevOps interviews test your knowledge of pipelines, repos, boards, artifacts, deployment strategies, and real-world CI/CD automation. This guide covers the 50 most common Azure DevOps interview questions with clear answers and practical examples.

Quick reference

Core concepts

1. What is Azure DevOps and what services does it include?

Azure DevOps is Microsoft's end-to-end DevOps platform. It includes five main services:

You can use all five together or connect individual services to third-party tools (GitHub, Jira, Jenkins).

2. What is the difference between Azure DevOps and GitHub Actions?

3. What is a pipeline agent in Azure DevOps?

An agent is a computing resource that runs pipeline jobs. Two types:

Microsoft-hosted agents — Azure manages the VM. Pre-installed tools for Windows, Ubuntu, and macOS. Spun up fresh for each job.

Self-hosted agents — You register your own machine (on-premises server, VM, container). Required when you need access to internal network resources, custom tools, or persistent build caches.

pool:
  vmImage: 'ubuntu-latest'   # Microsoft-hosted

pool:
  name: 'MyOnPremPool'       # Self-hosted pool

4. What is the difference between a stage, job, and step in Azure Pipelines?

Pipeline
└── Stage (e.g., Build, Test, Deploy)
    └── Job (runs on a single agent)
        └── Step (individual task or script)

5. What is the difference between Classic pipelines and YAML pipelines?

Microsoft recommends YAML pipelines for all new work.

Azure Repos

6. What branching strategies does Azure Repos support?

Azure Repos supports any Git branching model. The most common are:

7. What are branch policies in Azure Repos?

Branch policies protect important branches from direct pushes. You can require:

• Minimum number of reviewers
• Linked work item
• Successful build (build validation)
• Comment resolution before completing PR
• Status checks from external services

Azure Repos → Branches → Branch policies → main
✓ Require a minimum of 2 reviewers
✓ Check for linked work items
✓ Require a successful build (CI pipeline)
✓ Require comment resolution

8. What is a pull request (PR) template in Azure DevOps?

A PR template pre-fills the PR description with a standard structure. Create a file at:

.azuredevops/pull_request_template.md

or

.github/pull_request_template.md

Example template:

## Summary
<!-- What does this PR do? -->

## Type of change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor

## Testing
<!-- How was this tested? -->

## Related work items
Closes #

9. What is TFVC and how does it differ from Git in Azure Repos?

TFVC (Team Foundation Version Control) is a centralized version control system, while Git is distributed.

10. How do you resolve merge conflicts in Azure Repos?

1. Pull the target branch locally: git fetch origin main && git merge origin/main
2. Open conflicting files — look for <<<<<<<, =======, >>>>>>> markers
3. Edit to desired final state, remove markers
4. Stage resolved files: git add <file>
5. Complete the merge: git commit
6. Push: git push

Azure DevOps also provides an in-browser conflict resolution editor for PRs.

Azure Pipelines — YAML

11. What is a trigger in Azure Pipelines YAML?

Triggers control when a pipeline runs automatically.

trigger:
  branches:
    include:
      - main
      - release/*
    exclude:
      - feature/experimental
  paths:
    include:
      - src/
    exclude:
      - docs/

pr:
  branches:
    include:
      - main

trigger fires on pushes; pr fires on pull requests. Set trigger: none to disable automatic runs.

12. What is a scheduled trigger?

schedules:
  - cron: "0 2 * * 1-5"        # 2 AM weekdays UTC
    displayName: Nightly build
    branches:
      include:
        - main
    always: true                # Run even if no code changes

Cron syntax: minute · hour · day-of-month · month · day-of-week.

13. How do you pass variables between jobs in Azure Pipelines?

Use output variables:

jobs:
  - job: BuildJob
    steps:
      - bash: echo "##vso[task.setvariable variable=buildVersion;isOutput=true]1.2.3"
        name: setVersion

  - job: DeployJob
    dependsOn: BuildJob
    variables:
      VERSION: $[ dependencies.BuildJob.outputs['setVersion.buildVersion'] ]
    steps:
      - bash: echo "Deploying version $(VERSION)"

14. What is a pipeline template?

Templates let you reuse pipeline code across multiple pipelines. Two types:

Step template (templates/steps/build.yml):

parameters:
  - name: configuration
    default: 'Release'
steps:
  - task: DotNetCoreCLI@2
    inputs:
      command: 'build'
      arguments: '--configuration ${{ parameters.configuration }}'

Use in pipeline:

steps:
  - template: templates/steps/build.yml
    parameters:
      configuration: 'Debug'

15. What is a matrix strategy in Azure Pipelines?

Matrix runs the same job with different variable combinations:

jobs:
  - job: Test
    strategy:
      matrix:
        Python38:
          pythonVersion: '3.8'
        Python311:
          pythonVersion: '3.11'
        Python312:
          pythonVersion: '3.12'
    steps:
      - task: UsePythonVersion@0
        inputs:
          versionSpec: '$(pythonVersion)'
      - script: pytest tests/

Creates three parallel jobs, one per Python version.

16. How do you use conditions in Azure Pipelines?

steps:
  - script: echo "Always runs"
    condition: always()

  - script: echo "Only on main branch"
    condition: eq(variables['Build.SourceBranchName'], 'main')

  - script: echo "Only on success"
    condition: succeeded()

  - script: echo "Only on failure"
    condition: failed()

  - task: PublishBuildArtifacts@1
    condition: and(succeeded(), eq(variables['Build.Reason'], 'Schedule'))

17. What is dependsOn in Azure Pipelines?

dependsOn defines execution order and dependencies between stages or jobs:

stages:
  - stage: Build
    jobs:
      - job: Compile

  - stage: Test
    dependsOn: Build
    jobs:
      - job: UnitTests
      - job: IntegrationTests

  - stage: Deploy
    dependsOn:
      - Build
      - Test
    condition: succeeded('Build', 'Test')

18. How do you cache dependencies in Azure Pipelines?

variables:
  npm_config_cache: $(Pipeline.Workspace)/.npm

steps:
  - task: Cache@2
    inputs:
      key: 'npm | "$(Agent.OS)" | package-lock.json'
      restoreKeys: |
        npm | "$(Agent.OS)"
      path: $(npm_config_cache)

  - script: npm ci

Cache key uses a hash of package-lock.json. Cache is restored if key matches, saving install time.

19. What are service connections in Azure DevOps?

Service connections store credentials for external services — used by pipeline tasks without exposing secrets in YAML. Common types:

Created at: Project Settings → Service connections.

20. What is an environment in Azure Pipelines?

An environment is a deployment target (Kubernetes namespace, virtual machine, or logical group) with:

• Deployment history per environment
• Approval gates — require manual approval before deployment
• Checks — invoke REST APIs, query Azure Monitor alerts

stages:
  - stage: DeployProd
    jobs:
      - deployment: DeployApp
        environment: production         # matches environment name in ADO
        strategy:
          runOnce:
            deploy:
              steps:
                - script: kubectl apply -f k8s/

Deployment strategies

21. What deployment strategies does Azure Pipelines support?

strategy:
  rolling:
    maxParallel: 25%     # update 25% of instances at a time
    preDeploy:
      steps: [ ... ]
    deploy:
      steps: [ ... ]
    routeTraffic:
      steps: [ ... ]
    postRouteTraffic:
      steps: [ ... ]
    on:
      failure:
        steps: [ ... ]
      success:
        steps: [ ... ]

22. What is a canary deployment?

A canary deployment sends a small percentage of traffic to the new version before full rollout. If metrics stay healthy, rollout continues; otherwise roll back.

strategy:
  canary:
    increments: [10, 50]    # 10% → 50% → 100%
    preDeploy:
      steps:
        - script: echo "Pre-deploy validation"
    deploy:
      steps:
        - task: KubernetesManifest@0
          inputs:
            action: deploy
            manifests: k8s/deployment.yaml
    postRouteTraffic:
      steps:
        - script: run-smoke-tests.sh
    on:
      failure:
        steps:
          - script: kubectl rollout undo deployment/myapp

23. What is an approval gate and how do you configure it?

Approval gates pause pipeline execution until a designated person approves.

Configure:

1. Go to Environments → select environment
2. Click "Approvals and checks"
3. Add "Approvals" → add approver users/groups
4. Set timeout and instructions

When the pipeline reaches that environment's deployment job, it waits for approval before continuing.

Azure Artifacts

24. What is Azure Artifacts?

Azure Artifacts is a package management service supporting:

A feed is a scoped repository. Feeds can have upstream sources (npmjs.com, nuget.org) so developers get public and private packages from one endpoint.

25. What are upstream sources in Azure Artifacts?

Upstream sources proxy public registries through your feed. Benefits:

• Save clean copies of public packages used by your team
• Block malicious or deprecated versions
• Build in air-gapped environments using cached packages

# Add upstream to feed via CLI
az artifacts universal publish \
  --organization https://dev.azure.com/myorg \
  --feed my-feed \
  --name my-package \
  --version 1.0.0 \
  --path ./dist

Azure Boards

26. What work item types does Azure Boards support?

Default work item hierarchy for Agile process:

Epic
└── Feature
    └── User Story
        └── Task / Bug

For Scrum process: Epic → Feature → Product Backlog Item → Task / Bug
For CMMI: Epic → Feature → Requirement → Task / Bug / Change Request

27. What is a sprint in Azure Boards?

A sprint (or iteration) is a fixed time-box (usually 1–4 weeks) where the team commits to completing a set of work items. In Azure Boards:

• Sprints are defined under Project Settings → Boards → Team Configuration
• Work items are assigned to sprints via the backlog or sprint planning view
• The sprint board shows items in To Do / In Progress / Done columns
• Velocity and burndown charts track progress

28. What is the difference between Kanban board and sprint board?

29. How do you query work items in Azure Boards?

Use the Queries editor (Boards → Queries):

Work Item Type = User Story
AND State <> Done
AND Assigned To = @Me
AND Tags CONTAINS "priority-1"

Queries can be flat lists, tree (hierarchical), or one-hop (parent + children). Save as shared queries for team reuse. Queries can also feed dashboards and widgets.

30. How do you link Azure Boards work items to commits and PRs?

Include the work item ID in commit messages or PR titles:

git commit -m "Fix login timeout #1234"

Or link manually in the PR sidebar. Branch policies can require linked work items before a PR can complete. This creates traceability: work item → commit → build → release.

Security

31. What are variable groups in Azure DevOps?

Variable groups store shared variables and secrets used across multiple pipelines.

variables:
  - group: production-secrets    # reference variable group by name

steps:
  - script: echo $(DB_CONNECTION_STRING)

Variable groups can be linked to Azure Key Vault — secrets are synced at pipeline runtime without being stored in Azure DevOps.

32. What is the difference between a pipeline variable and a secret variable?

variables:
  MY_VAR: "hello"             # plain
  MY_SECRET: $(secretValue)   # secret from variable group or Key Vault

33. How do you manage secrets securely in Azure Pipelines?

Best practices:

1. Azure Key Vault — store secrets there, link feed to variable group, never hardcode
2. Mark pipeline variables as secret — masked in logs
3. Avoid echo-ing secrets or printing environment variables
4. Use service connections with managed identity (no stored credentials)
5. Set isSecret: true for output variables derived from secrets
6. Rotate secrets regularly; pipelines pick up new values automatically via Key Vault link

34. What are pipeline permissions and how do you control them?

Permissions operate at multiple levels:

Assign permissions to Azure AD users, groups, or service accounts via Project Settings → Permissions.

35. What is a service principal and how is it used in Azure DevOps?

A service principal is an Azure AD identity for applications and automation — equivalent to a service account. Used in Azure DevOps as:

• Service connection authentication: pipeline tasks authenticate to Azure using the service principal's client ID + secret (or certificate)
• Managed identity: Azure-hosted agents can use the VM's managed identity — no stored credentials at all

# Create service principal
az ad sp create-for-rbac --name "ado-deploy-sp" --role Contributor \
  --scopes /subscriptions/<sub-id>/resourceGroups/<rg>

Testing

36. What is Azure Test Plans?

Azure Test Plans provides:

• Manual test plans and test suites (static, requirement-based, query-based)
• Exploratory testing via the Test Runner browser extension
• Automated test results surfaced from pipeline runs
• Test reporting with charts, pass/fail trends, and coverage metrics

37. How do you publish test results in an Azure Pipeline?

steps:
  - script: pytest tests/ --junitxml=test-results.xml --cov=src --cov-report=xml

  - task: PublishTestResults@2
    inputs:
      testResultsFormat: 'JUnit'
      testResultsFiles: 'test-results.xml'
      failTaskOnFailedTests: true

  - task: PublishCodeCoverageResults@1
    inputs:
      codeCoverageTool: 'Cobertura'
      summaryFileLocation: 'coverage.xml'

Results appear on the pipeline run summary and in Azure Test Plans.

38. What is a quality gate in Azure DevOps?

Quality gates are automated checks that must pass before a stage proceeds:

• Build validation (PR policy): CI build must pass before PR completes
• Test percentage pass rate: fail the pipeline if <95% of tests pass
• Code coverage threshold: fail if coverage drops below 80%
• Security scan: fail on critical vulnerabilities (integrate with SonarQube, Snyk)
• Approval: manual approval required (environment check)

Advanced topics

39. What is a multi-stage pipeline and why use one?

A multi-stage pipeline defines Build → Test → Deploy stages in a single YAML file. Benefits:

• Single source of truth for entire delivery process
• Stage-level approvals and conditions
• Environment deployment history
• Canary and rolling strategies per stage

stages:
  - stage: Build
    jobs:
      - job: BuildApp
        steps: [ ... ]

  - stage: QA
    dependsOn: Build
    jobs:
      - deployment: DeployQA
        environment: qa
        strategy:
          runOnce:
            deploy:
              steps: [ ... ]

  - stage: Production
    dependsOn: QA
    condition: and(succeeded(), eq(variables['Build.SourceBranchName'], 'main'))
    jobs:
      - deployment: DeployProd
        environment: production
        strategy:
          runOnce:
            deploy:
              steps: [ ... ]

40. What are pipeline decorators?

Pipeline decorators are Azure DevOps extensions that inject steps into every pipeline run in an organization — without modifying individual YAML files. Used for:

• Enforcing security scans on all pipelines
• Adding mandatory compliance checks
• Injecting logging or telemetry

Decorators are defined in a VSTS extension (TypeScript) and published to the Marketplace or installed privately.

41. How do you implement GitOps with Azure DevOps?

GitOps uses git as the single source of truth for infrastructure and application state:

1. Application code + Kubernetes manifests live in Azure Repos
2. Azure Pipeline builds image, updates manifest with new image tag, commits back to repo
3. A GitOps operator (Flux or Argo CD) watches the manifest repo and reconciles cluster state

# Pipeline step: update image tag in manifest and commit
- script: |
    sed -i "s|image: myapp:.*|image: myapp:$(Build.BuildId)|" k8s/deployment.yaml
    git config user.email "pipeline@myorg.com"
    git config user.name "Azure Pipeline"
    git commit -am "ci: update image to $(Build.BuildId)"
    git push

42. What is the ##vso[task.setvariable] logging command?

Logging commands let pipeline steps communicate with the agent at runtime:

# Set a pipeline variable (available in subsequent steps of same job)
echo "##vso[task.setvariable variable=myVar]value"

# Set output variable (accessible in dependent jobs)
echo "##vso[task.setvariable variable=myVar;isOutput=true]value"

# Set secret variable
echo "##vso[task.setvariable variable=mySecret;isSecret=true]secretValue"

# Add a warning
echo "##vso[task.logissue type=warning]Configuration missing"

# Fail the step
echo "##vso[task.complete result=Failed;]Build validation failed"

43. How do you use pipeline parameters?

Parameters differ from variables: they are typed, validated, and set at queue time.

parameters:
  - name: environment
    displayName: Target environment
    type: string
    default: staging
    values:
      - staging
      - production

  - name: runTests
    displayName: Run tests
    type: boolean
    default: true

stages:
  - stage: Deploy_${{ parameters.environment }}
    jobs:
      - job: Deploy
        steps:
          - ${{ if eq(parameters.runTests, true) }}:
            - script: pytest tests/
          - script: deploy.sh ${{ parameters.environment }}

44. How do you set up a self-hosted agent?

# On the target machine (Linux)
mkdir ~/azagent && cd ~/azagent

# Download agent package from Azure DevOps
curl -O https://vstsagentpackage.azureedge.net/agent/3.x/vsts-agent-linux-x64-3.x.x.tar.gz
tar zxvf vsts-agent-linux-x64-*.tar.gz

# Configure
./config.sh --url https://dev.azure.com/myorg \
            --auth pat \
            --token <PAT_TOKEN> \
            --pool MyAgentPool \
            --agent MyAgent

# Install as service
sudo ./svc.sh install
sudo ./svc.sh start

Agent pools are created under Organization Settings → Agent pools.

45. How do you trigger a pipeline from another pipeline?

Build completion trigger (Classic / YAML):

# In the downstream pipeline
resources:
  pipelines:
    - pipeline: upstream
      source: 'My Upstream Pipeline'
      trigger:
        branches:
          include:
            - main

REST API trigger (manual):

curl -X POST \
  "https://dev.azure.com/myorg/myproject/_apis/pipelines/42/runs?api-version=7.1" \
  -H "Authorization: Basic $(echo -n :$PAT | base64)" \
  -H "Content-Type: application/json" \
  -d '{"resources":{"repositories":{"self":{"refName":"refs/heads/main"}}}}'

Scenario questions

46. How would you design a CI/CD pipeline for a containerized microservice?

stages:
  - stage: CI
    jobs:
      - job: BuildAndTest
        steps:
          - task: Docker@2
            displayName: Build image
            inputs:
              command: build
              tags: $(Build.BuildId)

          - script: |
              docker run --rm myapp:$(Build.BuildId) pytest tests/
            displayName: Run tests in container

          - task: Docker@2
            displayName: Push to ACR
            inputs:
              command: push
              containerRegistry: my-acr-connection
              tags: |
                $(Build.BuildId)
                latest

  - stage: DeployStaging
    dependsOn: CI
    jobs:
      - deployment: DeployToStaging
        environment: staging
        strategy:
          runOnce:
            deploy:
              steps:
                - task: KubernetesManifest@0
                  inputs:
                    action: deploy
                    kubernetesServiceConnection: aks-staging
                    manifests: k8s/staging/*.yaml
                    containers: myacr.azurecr.io/myapp:$(Build.BuildId)

  - stage: DeployProd
    dependsOn: DeployStaging
    jobs:
      - deployment: DeployToProduction
        environment: production    # has manual approval gate
        strategy:
          canary:
            increments: [20, 100]
            deploy:
              steps:
                - task: KubernetesManifest@0
                  inputs:
                    action: deploy
                    manifests: k8s/prod/*.yaml

47. A pipeline keeps failing intermittently with "agent not found." What do you check?

1. Agent pool capacity — are all agents busy? Add more agents or scale out
2. Agent status — go to Organization Settings → Agent pools → check if agents are online
3. Agent demands — pipeline may require capabilities (demands: node.js) that no available agent satisfies
4. Timeout — job waiting too long for an agent hits the queue timeout (default 60 min)
5. Self-hosted agent service — check if the agent service is running: sudo ./svc.sh status
6. Network — self-hosted agent may have lost connectivity to Azure DevOps

48. How do you prevent secrets from being leaked in pipeline logs?

1. Mark variables as secret (masked with *** automatically)
2. Never pass secrets as command-line arguments — use environment variables
3. Avoid set -x in bash scripts when secrets are in scope
4. Use ##vso[task.setvariable variable=x;isSecret=true] for derived values
5. Don't echo environment variables in debug steps
6. Use Key Vault references instead of storing secrets in Azure DevOps at all

# WRONG: secret visible in logs
- script: deploy.sh --password $(DB_PASSWORD)

# CORRECT: pass as env var (masked in logs)
- script: deploy.sh
  env:
    DB_PASSWORD: $(DB_PASSWORD)

49. How do you implement infrastructure as code (IaC) deployment in Azure DevOps?

Using Terraform:

stages:
  - stage: Plan
    jobs:
      - job: TerraformPlan
        steps:
          - task: TerraformInstaller@0
            inputs:
              terraformVersion: '1.8.0'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'init'
              backendServiceArm: 'my-azure-connection'
              backendAzureRmResourceGroupName: 'tf-state-rg'
              backendAzureRmStorageAccountName: 'tfstate123'
              backendAzureRmContainerName: 'tfstate'
              backendAzureRmKey: 'prod.terraform.tfstate'

          - task: TerraformTaskV4@4
            name: terraformPlan
            inputs:
              provider: 'azurerm'
              command: 'plan'
              environmentServiceNameAzureRM: 'my-azure-connection'
              commandOptions: '-out=tfplan'

  - stage: Apply
    dependsOn: Plan
    jobs:
      - deployment: TerraformApply
        environment: production
        strategy:
          runOnce:
            deploy:
              steps:
                - task: TerraformTaskV4@4
                  inputs:
                    provider: 'azurerm'
                    command: 'apply'
                    environmentServiceNameAzureRM: 'my-azure-connection'
                    commandOptions: 'tfplan'

50. How do you monitor and troubleshoot Azure Pipelines performance?

# Add retry for flaky tasks
- task: AzureCLI@2
  retryCountOnTaskFailure: 3
  inputs:
    azureSubscription: my-connection
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: az webapp deploy ...

Azure DevOps vs related tools

Common mistakes

FAQ

Q: What is the difference between a PAT and a service connection?
A PAT (Personal Access Token) is tied to a user account and expires. A service connection uses a service principal or managed identity — not tied to any user, does not expire by default, and is the recommended approach for pipeline authentication.

Q: Can Azure Pipelines deploy to on-premises servers?
Yes. Use a self-hosted agent installed on the server, or use deployment groups (an older mechanism for VM deployments). The agent establishes an outbound connection to Azure DevOps — no inbound firewall changes needed.

Q: What is the free tier for Azure Pipelines?
Public projects: unlimited free parallel jobs. Private projects: 1 free Microsoft-hosted parallel job (1,800 minutes/month) + 1 free self-hosted parallel job. Additional parallel jobs are purchased.

Q: How do you version Azure Pipelines templates?
Reference templates from a separate repository using a specific branch, tag, or commit:

resources:
  repositories:
    - repository: templates
      type: git
      name: MyOrg/pipeline-templates
      ref: refs/tags/v1.2.0

steps:
  - template: steps/build.yml@templates

Q: What is the difference between condition on a step vs a stage?
Stage conditions evaluate before any jobs run in the stage (controlled by dependsOn success/failure). Step conditions evaluate at runtime within a job — the job has already started. Stage conditions are better for skipping entire deployment stages; step conditions for conditional logic within a job.

Q: Can I run Azure Pipelines locally for testing?
Not natively — there is no local runner. Alternatives: use act for GitHub Actions syntax, or mock the YAML logic in a local script. For troubleshooting, add - bash: env steps to dump the agent environment, or use the Azure DevOps YAML schema validation in VS Code (Azure Pipelines extension).