Azure Learning

dependency-management

Properties2
tagsaz-400, dependency, packages, devops, supply-chain
aliasespackage management, dependency management strategy, supply chain management

2 min read

Dependency management

What it is

Dependency management is the practice of centralizing, versioning, securing, and controlling the packages and libraries your applications consume — both the third-party packages you pull in and the internal packages your own teams produce. In Azure DevOps the centerpiece is Azure Artifacts, which hosts feeds of NuGet, npm, Maven, Python, Cargo, Go, and Universal packages.

Why it exists

Applications are composed largely of packages they don’t write. If those packages are pulled ad-hoc from public sources, teams can’t control versions, provenance, licensing, or security, and the build is non-reproducible. Centralized dependency management makes builds reproducible and auditable, enforces a single source of truth, and hardens the supply chain against known vulnerabilities and tampering.

Key ideas

  • Feed as single source of truth — a feed is a scoped, permission-controlled repository of packages that the whole org or team consumes.
  • Version control for packages — SemVer + immutable package versions mean a build always resolves the same bits.
  • Upstream sources — feeds can cache public packages (nuget.org, npmjs) through upstreams so builds don’t depend directly on the internet.
  • Governance — permissions (who can read/publish), retention policies, deprecation, and promotion/views control package lifecycles.
  • Supply chain security — a dependency management strategy is part of a dependency graph and feeds vulnerability scanning (dependency vulnerabilities).

How it fits

azure-artifacts-overview.svg

Exam notes

  • Azure Artifacts is the AZ-400 answer to “centralized package management” — know it as the alternative to hand-rolling package storage.
  • Feeds are project-scoped or org-scoped; org feeds are shareable across projects.
  • Package versions are immutable once published — you cannot delete and republish a version, only retire/deprecate it.
  • Upstream caching makes builds reproducible even when the public source is down.

azure-artifacts · package-feed · upstream-sources · dependency-graph · pipeline-integration · semantic-versioning · dependency-vulnerabilities · build-artifact

📘 Source: Microsoft Learn — Dependency Management

Graph View

Backlinks