Azure Artifacts

What it is

Azure Artifacts is Azure DevOps package management. It lets teams create feeds to host and share NuGet, npm, Maven, Python, Cargo, and Universal Packages. A package feed is for reusable dependencies or tools; it is not the same as a pipeline build artifact.

Why it exists

Without a private package host, internal libraries have to be copied around or fetched from public registries, leading to version drift, broken builds, and supply-chain risk. Azure Artifacts gives a governed, permission-controlled place to store packages and cache upstream dependencies, so builds are reproducible and consumption is auditable.

Key ideas

• Feeds: the core container. A feed can be project-scoped or organization-scoped and holds packages, versions, views, upstream sources, and permissions.
• Upstream sources: a feed can save packages pulled from public registries or internal feeds. This gives a governed cache, but the team still needs to evaluate dependencies for security and licensing.
• Permissions: control who can read, publish, promote, or administer packages. A private feed requires an authenticated identity with the relevant feed permission.
• Views: read-only subsets of a feed used to expose selected versions to consumers. A feed includes @local, @prerelease, and @release by default; the latter two can be renamed or removed.
• Package types: NuGet, npm, Maven, Python, Cargo, and Universal Packages. A single feed can host multiple supported package types.
• Retention and recovery: manage storage and deletion deliberately. Deleting a package or feed can affect builds that depend on it.

Northwind example

Northwind publishes its shared receipt-rendering library to a project-scoped feed. The API pipeline restores a tested version through the feed instead of downloading an unpinned package ad hoc. A release manager exposes an approved version through the release view, while development versions stay out of that consumer path. The pipeline’s build identity needs only the feed permission required to restore or publish—never broad organization ownership.

How it fits

Diagrams courtesy of Microsoft Learn / Azure docs: azure/devops/artifacts/start-using-azure-artifacts

Exam notes

• Feeds are project- or organization-scoped; select scope based on the consumers that genuinely need access.
• Upstream sources improve availability and control but do not make a dependency safe or permanently reproducible by themselves.
• Package feed, pipeline artifact, and container image are different delivery objects with different consumers and retention needs.

Related

dependency-management · package-feed · upstream-sources · dependency-graph · pipeline-integration · build-artifact

📘 Sources: Microsoft Learn — Azure Artifacts documentation and Azure Artifacts key concepts