Skip to content

Commit 67b934b

Browse files
Merge pull request #8013 from MicrosoftDocs/users/glmorale/sprint247releasenotes
Azure DevOps Sprint 257 release notes
2 parents a78f661 + 7c2a8b7 commit 67b934b

31 files changed

+461
-3
lines changed
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
title: Azure DevOps release notes - Azure DevOps Sprint 257 Update
3+
description: See the Sprint 257 feature updates for Azure DevOps, including next steps.
4+
author: gloridelmorales
5+
ms.author: glmorale
6+
ms.date: 6/16/2025
7+
---
8+
9+
# Azure DevOps - Sprint 257 Update
10+
11+
## Features
12+
13+
[!INCLUDE [sprint-257-update-links](../includes/general/sprint-257-update-links.md)]
14+
15+
[!INCLUDE [sprint-257-update](../includes/general/sprint-257-update.md)]
16+
17+
[!INCLUDE [nextsteps](../includes/nextsteps.md)]
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
title: Azure DevOps release notes - GitHub Advanced Security for Azure DevOps 257 Update
3+
description: See the Sprint 257 feature updates for GitHub Advanced Security for Azure DevOps, including next steps.
4+
author: gloridelmorales
5+
ms.author: glmorale
6+
ms.date: 6/16/2025
7+
---
8+
9+
# GitHub Advanced Security for Azure DevOps - Sprint 257 Update
10+
11+
## Features
12+
13+
[!INCLUDE [sprint-257-update-links](../includes/ghazdo/sprint-257-update-links.md)]
14+
15+
[!INCLUDE [sprint-257-update](../includes/ghazdo/sprint-257-update.md)]
16+
17+
[!INCLUDE [nextsteps](../includes/nextsteps.md)]

release-notes/2025/includes/general/sprint-255-update-links.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@ ms.date: 4/23/2025
66
ms.topic: include
77
---
88

9-
- [Manage high privilege scopes, pipeline decorators, and unpublished extensions](#manage-high-privilege-scopes-pipeline-decorators-and-unpublished-extensions)
9+
- [Manage high privilege scopes, pipeline decorators, and unpublished extensions](#manage-high-privilege-scopes-pipeline-decorators-and-unpublished-extensions)
10+
- [Overlapping Secrets for OAuth apps](#overlapping-secrets-for-oauth-apps)

release-notes/2025/includes/general/sprint-255-update.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,13 @@ We've added a new feature that flags these scopes on each organization's admin p
1515
> [!div class="mx-imgBorder"]
1616
> [![Screenshot of feedback box.](../../media/255-general-01.png "Screenshot of feedback box")](../../media/255-general-01.png#lightbox)
1717
18-
For more information, visit [documentation](/azure/devops/marketplace/manage-high-privilege-extensions) page.
18+
For more information, visit [documentation](/azure/devops/marketplace/manage-high-privilege-extensions) page.
19+
20+
### Overlapping Secrets for OAuth apps
21+
22+
Azure DevOps has introduced Overlapping Secrets for OAuth apps—a new feature available on both UI and API designed to streamline secret rotation and reduce downtime.
23+
24+
> [!div class="mx-imgBorder"]
25+
> [![Screenshot of applications settings.](../../media/255-general-02.png "Screenshot of of applications settings.")](../../media/255-general-02.png#lightbox)
26+
27+
With overlapping secrets, developers can generate a new secret while the old one remains valid, ensuring uninterrupted access during secret rotations. With this update, we also reduce the default secret validity period to 60 days. As Azure DevOps OAuth apps approach deprecation in 2026, this update provides a critical security improvement for teams still relying on them. Try it today to simplify your secret management and improve resilience. Learn more in our blog post.
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
author: gloridelmorales
3+
ms.author: glmorale
4+
ms.service: azure-devops
5+
ms.date: 6/16/2025
6+
ms.topic: include
7+
---
8+
9+
- [Restrict Personal Access Token (PAT) Creation Organization Policy now in Public Preview](#restrict-personal-access-token-pat-creation-organization-policy-now-in-public-preview)
10+
- [Removal of expired Azure DevOps OAuth Apps](#removal-of-expired-azure-devops-oauth-apps)
11+
- [Azure DevOps login flow no longer relies on Azure Resource Manager audience](#azure-devops-login-flow-no-longer-relies-on-azure-resource-manager-audience)
12+
- [New Microsoft Entra OAuth scopes](#new-microsoft-entra-oauth-scopes)
13+
- [Request Access URL availability](#request-access-url-availability)
Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
author: gloridelmorales
3+
ms.author: glmorale
4+
ms.service: azure-devops
5+
ms.date: 6/16/2025
6+
ms.topic: include
7+
---
8+
9+
### Restrict personal access token (PAT) creation organization policy now in public preview
10+
11+
We’ve introduced a new organization-level policy in Azure DevOps—Restrict personal access token (PAT) creation—now available in public preview. This long-requested feature allows Project Collection Administrators to control who can create or regenerate PATs, helping reduce token sprawl and improve security. When enabled, only users on an allowlist can generate PATs, with optional support for packaging scopes. The policy also blocks global PAT usage unless explicitly permitted. Learn more about this policy and best practices for implementing this change in [our blog post](https://devblogs.microsoft.com/devops/restricting-pat-creation-in-azure-devops-is-now-in-preview/)!
12+
13+
> [!div class="mx-imgBorder"]
14+
> [![Screenshot of Restrict personal access token creation.](../../media/257-general-01.png "Screenshot of Restrict personal access token creation.")](../../media/257-general-01.png#lightbox)
15+
16+
### Removal of expired Azure DevOps OAuth Apps
17+
18+
As we prepare for the end-of-life for Azure DevOps OAuth apps in 2026, we'll begin regularly removing apps with secrets that have expired more than six months ago (180 days ago). App owners of these inactive apps will be informed and if there’s any further need for the app registration between now and Azure DevOps OAuth’s end-of-life in 2026, you are asked to rotate the app secret before June 9 when we begin app deletions. [Learn more in our blog post](https://devblogs.microsoft.com/devops/spring-cleaning-cta-for-azure-devops-oauth-apps-with-expired-or-long-living-secrets/).
19+
20+
### Azure DevOps login flow no longer relies on Azure Resource Manager audience
21+
22+
We've removed a dependency on the Azure Resource Manager (ARM) resource when logging in or refreshing Entra access tokens used to access Azure DevOps. The ARM resource is often associated with the [Azure portal](https://portal.azure.com), and admins may want to restrict which users in their tenant can access the portal through Conditional Access policy (CAP) enforcement.
23+
24+
Due to ADO's previous reliance on ARM, admins had to permit all ADO users to bypass the ARM CAPs in order to use ADO. This is no longer necessary as we've removed the ARM resource audience requirement during signin and refresh token flows.
25+
26+
There remain a couple of notable exceptions. The following ​user groups may need continued access to ARM:
27+
1. Billing admins need access to ARM to setup billing and access subscriptions
28+
2. Service Connection creators require continued access to ARM for ARM role assignment and updates to MSIs.
29+
30+
### New Microsoft Entra OAuth scopes
31+
Azure DevOps has introduced two new Microsoft Entra OAuth scopes, vso.pats and vso.pats_manage to enhance security and control over personal access token (PAT) lifecycle management APIs. These scopes are now required for delegated flows that involve PAT creation and management, replacing the previously broad user_impersonation scope. This change enables app owners to reduce the permissions needed by their app to access PAT APIs. Downscope your `user_impersonation` apps to the minimum scopes needed today!
32+
33+
### Request Access URL availability
34+
35+
Azure DevOps administrators can disable the [**Request Access**](/azure/devops/organizations/accounts/disable-request-access-policy?view=azure-devops) policy and provide a URL for users to request access to an organization or project. This URL, previously available only to new users, is now also shown to existing users on the 404 page. To maintain confidentiality, the request access URL is displayed regardless of the project's existence.
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
author: gloridelmorales
3+
ms.author: glmorale
4+
ms.date: 6/16/2025
5+
ms.topic: include
6+
---
7+
8+
- [GitHub Advanced Security is now available as GitHub Secret Protection and Code Security for Azure DevOps](#github-advanced-security-is-now-available-as-github-secret-protection-and-code-security-for-azure-devops)
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
author: gloridelmorales
3+
ms.author: glmorale
4+
ms.date: 6/16/2025
5+
ms.topic: include
6+
---
7+
8+
### GitHub Advanced Security is now available as GitHub Secret Protection and Code Security for Azure DevOps
9+
10+
GitHub Secret Protection and GitHub Code Security can now be purchased as standalone products on Azure DevOps for new customers.
11+
12+
Secret Protection provides access to secret scanning, push protection, and security overview experiences. Code Security provides access to all dependency scanning, code scanning, and security overview experiences.
13+
14+
All existing Advanced Security customers can continue using the bundled product experience without disruptions. If you're a current Advanced Security customer and interested in switching to the standalone products, contact Azure DevOps support via the Azure Portal. You can file a support ticket for the GitHub Advanced Security for Azure DevOps service and select `Billing migration from bundled to standalone products` as the problem type.
15+
16+
For more information on these products, see the [Dev Blog](https://devblogs.microsoft.com/devops/github-secret-protection-and-github-code-security-for-azure-devops/).
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
author: gloridelmorales
3+
ms.author: glmorale
4+
ms.date: 6/16/2025
5+
ms.topic: include
6+
---
7+
8+
- [Managed DevOps Pools - Image Deprecations](#managed-devops-pools---image-deprecations)
9+
- [New Triggers page](#new-triggers-page)
10+
- [StringList parameter type](#stringlist-parameter-type)
11+
- [See the full YAML code of a pipeline run](#see-the-full-yaml-code-of-a-pipeline-run)
Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
---
2+
author: gloridelmorales
3+
ms.author: glmorale
4+
ms.date: 6/16/2025
5+
ms.topic: include
6+
---
7+
8+
### Managed DevOps Pools - Image Deprecations
9+
10+
Due to [Windows Server 2019 hosted image deprecation](/azure/devops/release-notes/2025/pipelines/sprint-256-update#windows-server-2019-hosted-image-deprecation-schedule) and [Ubuntu 20.04 deprecation](/azure/devops/release-notes/2025/pipelines/sprint-253-update#the-ubuntu-2004-pipeline-image-is-deprecated-and-will-be-retired-april-1), Managed DevOps Pools is deprecating the “Azure Pipelines – Windows Server 2019” image and Ubuntu 20.04 images. More details about the deprecations can be found [here](/azure/devops/managed-devops-pools/configure-images?view=azure-devops&branch=main&tabs=azure-portal#image-deprecation-schedule). You can read about life cycle of images offered by Managed DevOps Pools [here](/azure/devops/managed-devops-pools/configure-images?view=azure-devops&branch=main&tabs=azure-portal#image-lifecycle).
11+
12+
### New Triggers page
13+
14+
YAML pipelines provide you multiple powerful options to define when your pipeline should run. It's not always easy to reason if your pipeline is configured to run in response to an event, for example, a feeder pipeline completed.
15+
16+
This sprint, were introducing a **Triggers** page that gives you an overview of what triggers you have defined in your pipeline.
17+
18+
> [!div class="mx-imgBorder"]
19+
> [![Screenshot of Pipelines Triggers.](../../media/257-pipelines-01.png "Screenshot of Pipelines Triggers page.")](../../media/257-pipelines-01.png#lightbox)
20+
21+
Imagine you have the following YAML pipeline defined in the `main` branch of a repo. Consider there's also a `feature` branch that has the same YAML pipeline code.
22+
23+
```yaml
24+
trigger:
25+
- main
26+
27+
schedules:
28+
- cron: 0 0 * * *
29+
always: true
30+
displayName: Nightly build
31+
branches:
32+
include:
33+
- main
34+
35+
resources:
36+
pipelines:
37+
- pipeline: FabrikamFiber
38+
source: FabrikamFiber
39+
trigger: true
40+
```
41+
42+
When you navigate to the **Triggers** page, you see the following
43+
44+
> [!div class="mx-imgBorder"]
45+
> [![Screenshot of Continuous integration triggers.](../../media/257-pipelines-02.png "Screenshot of triggers page select branch with default branch main.")](../../media/257-pipelines-02.png#lightbox)
46+
47+
Notice the default branch of the pipeline, `main`, is preselected.
48+
49+
You see there is a _Continuous integration trigger_ for this branch, and it's defined in the YAML file.
50+
51+
When you navigate to the _Schedule triggers_, you see there are triggers defined, and you can see their details.
52+
53+
> [!div class="mx-imgBorder"]
54+
> [![Screenshot of Pipelines schedule triggers.](../../media/257-pipelines-03.png "Screenshot of Pipelines schedule triggers details.")](../../media/257-pipelines-03.png#lightbox)
55+
56+
When you navigate to the _Resource triggers_ section, you see the defined resource triggers and their details.
57+
58+
> [!div class="mx-imgBorder"]
59+
> [![Screenshot of Pipelines resource triggers section.](../../media/257-pipelines-04.png "Screenshot of Pipelines resource triggers section.")](../../media/257-pipelines-04.png#lightbox)
60+
61+
You can switch branches, from `main` to `feature`, to see what triggers you defined for the `feature` branch.
62+
63+
> [!div class="mx-imgBorder"]
64+
> [![Screenshot of Pipelines continuous integration triggers.](../../media/257-pipelines-05.png "Screenshot of Pipelines continuous integration triggers.")](../../media/257-pipelines-05.png#lightbox)
65+
66+
> [!div class="mx-imgBorder"]
67+
> [![Screenshot of Pipelines scheduled triggers.](../../media/257-pipelines-06.png "Screenshot of Pipelines scheduled triggers.")](../../media/257-pipelines-06.png#lightbox)
68+
69+
> [!div class="mx-imgBorder"]
70+
> [![Screenshot of Pipelines continuous resource triggers.](../../media/257-pipelines-07.png "Screenshot of Pipelines continuous resource triggers.")](../../media/257-pipelines-07.png#lightbox)
71+
72+
In the _Resource triggers_ tab, when not on the default branch, you get a warning telling you the triggers defined for this branch are ignored.
73+
74+
When trigger definitions were not correctly processed by the system, you get a warning and indications on how to solve the problem.
75+
76+
> [!div class="mx-imgBorder"]
77+
> [![Screenshot of Pipelines schedule triggers with warning and indications on how to solve triggers are not processed.](../../media/257-pipelines-09.png "Screenshot of Pipelines schedule triggers with warning and indications on how to solve triggers are not processed.")](../../media/257-pipelines-07.png#lightbox)
78+
79+
### StringList parameter type
80+
81+
One of the top requested YAML pipelines features in the Developer Community is to [define parameters that contain a list of items](https://developercommunity.visualstudio.com/t/parameters-that-support-multiselect/1224839).
82+
83+
Starting with this sprint, we've added a new parameter type, named `StringList`, that provides this capability.
84+
85+
Say you want to allow those who queue pipeline runs to choose which regions they want to deploy a payload to. Now you can do this as shown in the example below.
86+
87+
```yaml
88+
parameters:
89+
- name: regions
90+
type: stringList
91+
displayName: Regions
92+
values:
93+
- WUS
94+
- CUS
95+
- EUS
96+
default:
97+
- WUS
98+
- CUS
99+
- EUS
100+
101+
stages:
102+
- ${{ each stage in parameters.regions}}:
103+
- stage: ${{stage}}
104+
displayName: Deploy to ${{stage}}
105+
jobs:
106+
- job:
107+
steps:
108+
- script: ./deploy ${{stage}}
109+
```
110+
111+
When queuing this pipeline, you have the option of choosing multiple regions to deploy to, as shown in the following screenshot.
112+
113+
> [!div class="mx-imgBorder"]
114+
> [![Screenshot of Run pipeline region multi selection.](../../media/257-pipelines-08.png "Screenshot of Run pipeline region multi selection.")](../../media/257-pipelines-08.png#lightbox)
115+
116+
### See the full YAML code of a pipeline run
117+
118+
YAML pipelines are composable. You may extend a template, to ensure your pipelines runs the necessary static analysis tools, and include templates to run common stages or jobs or tasks.
119+
120+
Debugging such pipelines was not easy, because you couldn't see the full YAML code it was running.
121+
122+
Say you have the following pipeline:
123+
```yaml
124+
parameters:
125+
- name: PoolName
126+
type: string
127+
default: Azure Pipelines
128+
- name: VmImage
129+
type: string
130+
default: ubuntu latest
131+
132+
extends:
133+
template: security-enforcing-template.yml
134+
parameters:
135+
jobs:
136+
- template: job.monitoring.yml
137+
- template: job.build.yml
138+
parameters:
139+
PoolName: ${{parameters.PoolName}}
140+
VmImage: ${{parameters.VmImage}}
141+
```
142+
143+
There are three templates used here. Each template may use conditional expressions based on parameter and variable values to determine the actual jobs or steps to run.
144+
145+
Furthermore, when looking at old pipeline runs, you don't know if the pipeline's code is the same now as when the run ran.
146+
147+
In this sprint, we're adding a new functionality that allows you to easily see the full YAML code of a pipeline run.
148+
149+
> [!div class="mx-imgBorder"]
150+
> [![Screenshot of pipeline summary with see full YAML option.](../../media/257-pipelines-10.png "Screenshot of pipeline summary with see full YAML option.")](../../media/257-pipelines-10.png#lightbox)

0 commit comments

Comments
 (0)