Azure Learning

provisioning-pipeline

Properties2
tagsdevops, iaac, provisioning-pipeline, infrastructure-as-code, pipelines
aliasesDeployment pipeline for IaC, IaC release pipeline

2 min read

Provisioning pipeline

What it is

A provisioning pipeline is the automated release process that takes your IaC definitions (bicep, ARM templates, or terraform) from source control and deploys them to Azure as a repeatable, gated Continuous Delivery flow — instead of running az deployment or terraform apply by hand. In Azure Pipelines or GitHub Actions this is a dedicated pipeline job/stage that init, plans, validates, and applies the infrastructure per environment.

Why it exists

Deploying infrastructure by hand is inconsistent and ungoverned. A provisioning pipeline gives infrastructure the same rigor as application code: CI on the definition (lint, validate, cost, what-if/plan), pull-request gating, separation of environments (dev → stage → prod), approvals and gates, and a rollback path — all with full history.

Key ideas

  • Stages mirror environments: build the artifact once, then deploy the definition to dev/stage/prod with environment-specific parameters.
  • Validation before apply: run Bicep lint + az deployment what-if / terraform plan; fail the pipeline instead of mis-provisioning.
  • Service connection / identity: the pipeline authenticates via a service principal (or managed identity) with least-privilege RBAC on the target scope — never a user’s credentials.
  • Reusability: template modules + parameter files keep the pipeline DRY; the same YAML drives all environments.
  • Guardrails: approvals & deployment gates on prod, locking of resource groups, and soft-delete/lock policy for protection.

How it fits (diagram)

Exam notes

  • The provisioning pipeline is the place AZ-400 tests IaC: parameter files per environment, service connections, what-if/plan gates, and deployment rings.
  • Know the flow for ARM/Bicep (az deployment group/sub what-if then create) and Terraform (init → plan → apply, backend on Storage account).
  • Key contrast: provisioning pipeline manages the resource layer; config-management agents handle inside-VM state — both are part of IaC governance.

infrastructure-as-code · bicep · arm-template · terraform · cd · azure-pipelines · deployment-gate

📘 Source: Microsoft Learn — Provisioning Pipeline

Graph View

Backlinks