Azure Learning

variables-groups

Properties2
tagsdevops, pipelines, variables, security, cd
aliasesvariable group, variable library, Azure DevOps variable groups, Libraries

2 min read

Variable Groups

What it is

A variable group is a set of variables stored once in Azure DevOps and shared across many pipelines/pipeline runs, rather than redefined per pipeline. Variable groups live under the Libraries hub and can be plain variables or Azure Key Vault–linked (each group variable maps to a secret value fetched at runtime).

Why it exists

Deploying to multiple environments (dev, test, prod) or many pipelines means the same connection strings, endpoints, and settings are needed everywhere. Duplicating them per pipeline causes drift and secrets sprawl. Variable groups give a single source of truth — one place to store, approve, and update values that many releases consume.

Key ideas

  • Plain variable group: stores non-secret values (server names, flags, URLs) — values visible in the UI.
  • Key Vault–linked variable group: each variable pulls its value from a named Azure Key Vault secret at runtime → good for secrets, enables rotation without editing the group.
  • Library scope: a group can be project-scoped (default) or pipeline-scoped (can be consumed across the whole org when protected).
  • Reference it via YAML variables: - group: <name> or in a release definition’s variable section.
  • Limits: up to a certain number of variables per group; secret-variable values cannot be read back via API.
  • Permissions: groups can be secured so only authorized roles/queues can use them (approvals for protected resources apply to secrets).

How it fits

Variable groups are the mechanism that connects secret stores to pipelines: a single Key Vault-linked group means your YAML just names secrets, and the actual rotation happens in the vault. Part of secure deployment because they keep secrets out of pipeline definitions.

Exam notes

  • Two kinds: variable group (Libraries) vs individual pipeline variables — group = shared across pipelines.
  • Link a group to Azure Key Vault to reference secrets by name and fetch at runtime.
  • Use protected / pipeline-scoped groups for security so untrusted pipelines can’t read secret values.
  • Group variables referenced in YAML by - group: <groupName>.

secrets-management · azure-pipelines · secure-cd · environment-approvals · deployment-gate

📘 Source: Microsoft Learn — Variables Groups

Graph View

Backlinks