Variable Groups and Libraries

MS Learn path: Implement secure continuous deployment — module 3.

Overview

Reusing configuration across pipelines and runs. Covers the Libraries hub, variable groups (plain and Key Vault–linked), and sharing non-secret settings centrally without duplicating them in YAML.

Units

  • What problem variable groups solve
  • Plain vs Key Vault–linked variable groups
  • Referencing groups from pipelines and releases
  • Securing groups (protected, pipeline-scoped) and value limits

Concepts introduced

Key terms & commands

  • variables: - group: <name> — consume a variable group in YAML.
  • Library: the Azure Pipelines hub where groups and secure files live.
  • Project vs pipeline scope: pipeline-scoped groups can be consumed org-wide and can be protected.
  • Plain group = visible non-secrets; Key Vault-linked group = secrets fetched at runtime.

Hands-on

⚠ verify — add: create a variable group in Libraries, reference it from a YAML pipeline, and link one to Key Vault.

Exam focus

  • Variable groups = shared variables, single source of truth across pipelines.
  • Key Vault-linked group = variables resolve to secrets at runtime (rotation-friendly).
  • Protected/pipeline-scoped groups restrict who can use them (security).

variables-groups · secrets-management · secure-cd · Path MOC