Azure Learning

dynamic-approval-checks

Properties2
tagsdevops, approvals, gates, cd, security
aliasesdynamically targeting approvals, approval targeting, environment checks, branch-filtered approvals

2 min read

Dynamic Approval Checks

What it is

Dynamic approval checks are approval rules that are evaluated and targeted at deployment time rather than hard-coded to a fixed approver. In Azure DevOps environment checks, a check can be an Approval check whose approvers are decided dynamically — resolved from variables, groups, user/mail fields, or derived at execution, instead of a static user list typed into the definition.

Why it exists

Release culture wants approvals, but a fixed approver list is brittle: the right owner for a release often depends on the branch, the environment, the change, or on-call rotation. Dynamic targeting lets a single deployment gate send the approval request to the appropriate team or person as circumstances dictate — no pipeline re-edit when ownership or routing changes.

Key ideas

  • A check is configured on an environment and runs before the stage; an Approval check pauses the pipeline until the target approves.
  • Dynamic targeting options let you resolve the approver at runtime from:
    • variables / macro expressions ($(approver)),
    • group memberships (dynamic group chosen at run),
    • filters like branch name or environment attribute — so a release to prod-from-main routes to the Release Managers while a hotfix routes elsewhere.
  • Combine with timeout & approval-time limits so a stuck approval can’t block a release forever.
  • Approvals differ from gates: approvals are human authorization; gates are usually automated checks (metrics, work items).

How it fits

Dynamic approval targeting is the “approval” half of environment checks and of deployment gates. It makes secure continuous deployment governable at scale: human sign-off goes to the right human automatically, without maintaining per-branch approval definitions.

Exam notes

  • Approvals are checks attached to environments/stages.
  • Dynamic approval members = resolved at runtime (from variables/fields/groups) — contrast with a static list of approvers.
  • Approvals pause the deployment (human in the loop); gates typically evaluate health/metrics automatically.
  • For multi-stage CD, approvals on the production environment alone are enough to gate the prod stage.

environment-approvals · deployment-gate · secure-cd · cd · release-definition

📘 Source: Microsoft Learn — Dynamic Approval Checks

Graph View

Backlinks