Environment Approvals
What it is
Environment approvals (specifically environment checks in Azure Pipelines) are the governance mechanism on an Environment: before a pipeline can deploy a stage that targets that environment, checks must pass. The core check is Approvals — a designated human (or group, possibly chosen dynamically) must explicitly Approve/Reject the deployment. Approval is one of several checks (others: pipeline, protected branch, business hours, custom/InvokeREST gate).
Why it exists
Even a fully automated CD pipeline shouldn’t push to production silently. Environment approvals put human accountability at the right gate: someone reviews and consents to a production deployment — while leaving everything else automatic. They turn the environment into an approval boundary so prod stays guarded without killing velocity.
Key ideas
- Environment = a logical deployment target with ownership (owner) and checks; stages deploy to an environment.
- Checks run before a stage that targets the environment; an Approval check schedules a review and blocks until approved/rejected.
- Approvers can be individuals or teams; support dynamic targeting so the approver is resolved at run time.
- Combine checks: require branch protection + approval + invoke REST / metrics gate for layered control on prod.
- Approvals are stage/environment scoped — typically only the production stage carries them; dev/stage are unattended.
How it fits
Environment approvals are the human-control pillar of secure continuous deployment; alongside automated gates (metrics, work items) and secret/identity management they gate each stage of the release. Approvals = who says yes; gates = does health say yes.
Exam notes
- Checks attach to environments, run pre-deployment for stages targeting them.
- Approval check = a person/group approves; can be dynamically targeted.
- Typical pattern: approval check on the production environment only, heavier automation elsewhere.
- Distinguish approvals (human sign-off) from gates (automated health/work-item checks).
Related
dynamic-approval-checks · deployment-gate · secure-cd · cd · release-definition
📘 Source: Microsoft Learn — Environment Approvals