Azure Repos Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for DevOps

Category

DevOps

1. Introduction

Azure Repos is Microsoft’s source control service in Azure DevOps. It provides hosted Git repositories (and also Team Foundation Version Control (TFVC) for centralized version control) with collaboration features like pull requests, branch policies, code reviews, and tight integration with the rest of Azure DevOps (Pipelines, Boards, Artifacts, and Test Plans).

In simple terms: Azure Repos is where your team stores and reviews code. Developers clone repositories, create branches, commit changes, open pull requests, get approvals, and merge to protected branches—without needing to self-host Git servers.

Technically, Azure Repos is a multi-tenant SaaS capability inside Azure DevOps Services (cloud) and also available in Azure DevOps Server (on-premises). It supports Git operations over HTTPS/SSH, identity-driven access control via Microsoft Entra ID (Azure AD) and Azure DevOps permissions, and governance controls (branch policies, required reviewers, build validation) that turn Git into an auditable, controlled change-management system.

The main problem Azure Repos solves is reliable, secure, scalable source control with enterprise-grade governance—especially for organizations already using Azure DevOps for CI/CD and work tracking.

2. What is Azure Repos?

Official purpose: Azure Repos provides source control repositories for your projects, primarily Git repos and optionally TFVC repos, hosted and managed by Azure DevOps.

Core capabilities

• Git repositories hosted in Azure DevOps projects
• TFVC repositories (centralized version control) for teams that still rely on TFVC
• Pull requests (PRs) with inline comments, iterations, and reviewers
• Branch policies (minimum reviewers, required linked work items, build validation, etc.)
• Repository permissions and granular security controls
• Web-based code browsing (history, blame, compare, diff)
• Integration hooks with Azure Pipelines and other DevOps tools

Major components

• Azure DevOps Organization: The top-level tenant boundary for Azure DevOps Services.
• Project: A container for repos, pipelines, boards, and permissions.
• Repository: Git repo (most common) or TFVC repo.
• Pull Requests: Review and merge workflow for Git branches.
• Branch Policies: Rules that gate changes to protected branches (like main).
• Identity & Permissions: Microsoft Entra ID users/groups, Azure DevOps groups, repo-level permissions, and optional PAT/SSH credentials.

Service type

• SaaS (Azure DevOps Services) for cloud-hosted source control
• Also available as self-hosted (Azure DevOps Server) if your organization requires on-premises hosting (separate product and licensing)

Scope and “where it lives”

Azure Repos is project-scoped within an Azure DevOps organization: – You create an organization (with a selected geography/region for data residency, depending on what Azure DevOps offers at creation time—verify in official docs for current region/geo options). – Within the organization, you create projects. – Within projects, you create repos and manage permissions/policies.

How it fits into the Azure ecosystem

Azure Repos commonly acts as the “source of truth” feeding: – Azure Pipelines for CI/CD triggers (PR validation and post-merge builds) – Azure Boards for linking code changes to work items – Azure Artifacts for package management – Azure Test Plans for test management (if used) – Integrations to Azure services (App Service, AKS, Functions) typically happen through pipelines, not directly through Repos

Official Azure DevOps documentation hub:
https://learn.microsoft.com/azure/devops/?view=azure-devops

3. Why use Azure Repos?

Business reasons

• Faster delivery with governance: PR-based workflows plus enforceable policies reduce rework and production defects.
• Lower operational overhead: No need to patch/scale self-hosted Git servers if you use Azure DevOps Services.
• Standardization: A consistent developer workflow across teams improves onboarding and compliance.

Technical reasons

• First-class Git hosting: Standard Git CLI works; supports SSH/HTTPS access.
• Strong PR + branch policy model: Enforce code review, CI checks, and traceability.
• Integration with Azure Pipelines: PR validation and CI triggers are straightforward and widely used.

Operational reasons

• Centralized access control: Manage permissions at org/project/repo/branch levels.
• Auditability: PR history, approvals, and policy evaluations create a change trail.
• Automation: Service hooks, REST APIs, and CLI can automate repo provisioning and governance (capabilities vary—verify in official docs for your scenario).

Security/compliance reasons

• Identity integration: Works with Microsoft Entra ID, MFA, conditional access (depending on tenant configuration).
• Least privilege: Fine-grained repo permissions and protected branches reduce risk.
• Traceability: Link commits/PRs to work items; enforce required reviewers and build validation.

Scalability/performance reasons

• Azure DevOps Services is designed to handle many repos and users without you managing the underlying infrastructure.
• Git performance still depends on repository health (history size, LFS usage, monorepo strategies, etc.).

When teams should choose Azure Repos

• You already use (or plan to use) Azure DevOps for pipelines/boards and want a unified platform.
• You need enterprise branch governance without stitching multiple tools together.
• You want managed hosting rather than running GitHub Enterprise Server, GitLab, or Azure DevOps Server on your own infrastructure.

When teams should not choose Azure Repos

• You require Git hosting deeply centered around open-source workflows and ecosystem features that are strongest in GitHub (issues, discussions, marketplace app ecosystem), and you don’t need Azure DevOps project structure.
• Your organization has standardized on GitHub Enterprise, GitLab, or Bitbucket and you want to reduce tool sprawl.
• You require on-prem-only hosting but are not deploying Azure DevOps Server (Azure Repos in Azure DevOps Services is cloud SaaS).

4. Where is Azure Repos used?

Industries

• Finance, healthcare, public sector, and manufacturing (where governance and audit trails matter)
• Retail, SaaS, media (fast iteration with controlled release flows)
• Education and research (team projects, course labs)

Team types

• Platform engineering teams enforcing standardized workflows
• Application development teams building web/mobile/backend systems
• SRE/operations teams managing infrastructure-as-code repositories
• Security teams implementing “policy as code” reviews and gated merges

Workloads and repository types

• Application code (API services, frontends, mobile apps)
• Infrastructure as Code (Bicep, Terraform, Kubernetes manifests, Helm charts)
• Data/analytics pipelines (code-driven ETL, SQL projects)
• Shared libraries and internal developer platforms

Architectures and deployment contexts

• Microservices with one repo per service (polyrepo)
• Monorepos (single repo for multiple components) with careful policy/performance considerations
• Regulated environments requiring formal review and approvals

Production vs dev/test usage

• Production-critical: Protected branches with mandatory PR reviews, build validation, and release gating downstream.
• Dev/test: Feature branches and experimental repos with lighter policies, often in separate projects for isolation.

5. Top Use Cases and Scenarios

Below are realistic scenarios where Azure Repos fits well. Each includes the problem, why Azure Repos fits, and an example.

1) Standard Git hosting for enterprise teams

• Problem: You need reliable Git hosting with enterprise controls and do not want to self-manage Git servers.
• Why Azure Repos fits: Managed Git repos with permissions, PRs, and branch policies.
• Example: A company migrates dozens of team repos from on-prem Git to Azure DevOps Services for easier scaling.

2) PR-based code review with compliance requirements

• Problem: Teams need auditable approvals and consistent review practices.
• Why this service fits: PR workflow plus enforced minimum reviewers and required comments.
• Example: A fintech team enforces “2 approvals + successful build” for all merges to main.

3) CI build validation on pull requests

• Problem: Code reaches protected branches with failing tests or broken builds.
• Why this service fits: Branch policies can require build validation (via Azure Pipelines).
• Example: Every PR must run unit tests and a lint job before it can be merged.

4) Infrastructure-as-Code change control

• Problem: Infra changes are risky and require peer review and traceability.
• Why this service fits: Branch protection + required work item linking can formalize change management.
• Example: A platform team requires PR approvals and a linked change ticket before merging Terraform updates.

5) Multi-team project structure with segmented permissions

• Problem: Different teams need separate repo permissions and governance within a shared organization.
• Why this service fits: Azure DevOps supports project boundaries and repo-level permissions.
• Example: HR apps and finance apps are separate projects; only designated groups can push to sensitive repos.

6) Migration from TFVC to Git (phased)

• Problem: Legacy teams use TFVC but want modern Git workflows without a “big bang” migration.
• Why this service fits: Azure Repos supports both TFVC and Git within Azure DevOps.
• Example: A team keeps TFVC for a legacy product while new services start in Git, later migrating history.

7) Secure internal code hosting with Entra ID controls

• Problem: You need to restrict access using corporate identity and enforce MFA/conditional access.
• Why this service fits: Azure DevOps integrates with Microsoft Entra ID for authentication.
• Example: Contractors get time-bound access; conditional access restricts sign-in from unmanaged devices (tenant feature).

8) Cross-repo dependency workflows for shared libraries

• Problem: Shared libraries change often and need PR validation across dependent repos.
• Why this service fits: Repo + pipeline integrations support CI triggers and versioning strategies.
• Example: A shared .NET library repo publishes internal packages; consumer repos pin versions and update via PRs.

9) Controlled release branch strategy (GitFlow or trunk-based)

• Problem: You need a consistent branching model and enforcement.
• Why this service fits: Branch policies can differ per branch (e.g., strict on main, lighter on develop).
• Example: Release branches require extra approvals and a successful integration test run.

10) Automated repo provisioning for new teams

• Problem: Creating repos, permissions, and policies manually is slow and inconsistent.
• Why this service fits: Azure DevOps supports automation via CLI/REST APIs (verify endpoints and auth).
• Example: A platform team provisions a repo template, sets default branch policies, and adds security groups automatically.

11) Vendor collaboration via limited-access projects

• Problem: External partners need access to specific code without exposing everything.
• Why this service fits: Fine-grained permissions and project-based separation.
• Example: A vendor gets read-only access to a single repo plus PR access to a feature branch.

12) Traceability from work item to commit to release

• Problem: Auditors want evidence connecting requirements to code changes and releases.
• Why this service fits: Link Azure Boards work items to commits/PRs; gate merges on linked work items.
• Example: A regulated team requires every PR to link to a user story and pass build validation.

6. Core Features

This section focuses on current, commonly used Azure Repos capabilities inside Azure DevOps.

1) Git repositories (hosted)

• What it does: Hosts Git repos accessible via standard Git clients over HTTPS or SSH.
• Why it matters: Git is the industry standard; compatibility reduces friction.
• Practical benefit: Developers use existing tooling; easy onboarding.
• Caveats: Large repos can become slow; use good Git hygiene and consider Git LFS for large binaries.

2) TFVC repositories (centralized source control)

• What it does: Offers Team Foundation Version Control for centralized workflows.
• Why it matters: Some legacy Microsoft-centric environments still depend on TFVC.
• Practical benefit: Supports gradual modernization.
• Caveats: TFVC is not the default modern choice; most new projects should use Git unless there is a specific constraint.

3) Pull requests (PRs) and code reviews

• What it does: Enables review workflows with reviewers, comments, iterations, and merge strategies.
• Why it matters: PRs are the center of collaboration and quality controls.
• Practical benefit: Fewer defects, better knowledge sharing, safer changes.
• Caveats: PRs add process overhead; keep PRs small and use automation.

4) Branch policies (protected branches)

Common policy types include (availability can depend on configuration—verify in official docs): – Minimum number of reviewers – Required reviewers (e.g., code owners-like enforcement via required reviewer groups) – Check for linked work items – Check for comment resolution – Build validation (requires a pipeline) – Status checks (integration-based)

• Why it matters: Policies convert “best practices” into enforceable rules.
• Practical benefit: Prevents direct pushes to main and ensures CI checks run.
• Caveats: Overly strict policies can slow delivery; tune policies by repo criticality.

5) Repository permissions and security controls

• What it does: Allows granular permissions at org/project/repo/branch levels (read, contribute, create branch, force push, manage permissions, etc.).
• Why it matters: Supports least privilege and separation of duties.
• Practical benefit: Reduces risk of accidental or malicious changes.
• Caveats: Misconfigured inheritance can lead to unexpected access; periodically review effective permissions.

6) Web-based repository browsing and history

• What it does: Provides UI for browsing files, history, diffs, compare, and blame.
• Why it matters: Enables reviews and debugging without local clones.
• Practical benefit: Quick investigation of “what changed and why.”
• Caveats: For deep analysis, local tooling is still better.

7) Commit and PR linking to Azure Boards work items

• What it does: Connects code changes to work tracking for traceability.
• Why it matters: Auditable workflows and better planning.
• Practical benefit: Easier release notes, compliance reporting, and impact analysis.
• Caveats: Requires discipline; consider enforcing via branch policies if needed.

8) Service hooks and integrations

• What it does: Notifies external systems (chat, ITSM, CI tools) on repo events (push, PR creation, merge, etc.).
• Why it matters: Enables automation and collaboration across tools.
• Practical benefit: Auto-create tickets, post PR notifications to Teams, trigger external workflows.
• Caveats: Treat hooks as part of your security boundary; control who can configure them.

9) REST APIs and Azure DevOps CLI automation

• What it does: Programmatically manage repos, policies, permissions, and PRs (capability coverage varies—verify per API).
• Why it matters: Enables “repo governance as code” and large-scale standardization.
• Practical benefit: Provision projects and repositories consistently.
• Caveats: Requires secure credential handling (PATs/service principals where applicable).

10) SSH keys and Personal Access Tokens (PATs)

• What it does: Supports Git over SSH (using uploaded SSH public keys) and HTTPS auth using PATs.
• Why it matters: Secure authentication options for different environments.
• Practical benefit: SSH keys for dev machines; PATs for automation (with care).
• Caveats: PAT sprawl is a common risk; use minimal scopes and rotation policies.

7. Architecture and How It Works

High-level service architecture

In Azure DevOps Services, Azure Repos is a hosted component accessed via: – Web UI (Azure DevOps portal) – Git clients (HTTPS/SSH) – REST APIs / Azure DevOps CLI

Key logical planes: – Control plane: Org/project configuration, permissions, policies. – Data plane: Git objects, refs, PR metadata, review comments.

Request/data/control flow (typical Git + PR workflow)

1. A developer authenticates (Entra ID) and clones a repo using HTTPS/SSH.
2. The developer creates a branch, commits locally, and pushes to Azure Repos.
3. The developer opens a PR to merge into main.
4. Branch policies evaluate: – Required reviewers approval – Linked work item requirement (if enabled) – Build validation pipeline execution (if enabled)
5. After policies pass, PR is completed (merge). Post-merge CI/CD triggers can run.

Integrations with related services

Common integrations (most are Azure DevOps components): – Azure Pipelines: PR validation and CI triggers – Azure Boards: Work item linking and traceability – Azure Artifacts: Package feeds referenced by builds – Microsoft Teams/Slack: PR notifications via service hooks/apps – Security tooling: Code scanning often runs in pipelines; some orgs also use Defender for DevOps (outside Repos scope—verify current integration options)

Dependency services

• Microsoft Entra ID for identity (for most organizations)
• Azure DevOps Services for hosting and permissions model
• Optional: self-hosted build agents for CI if using build validation

Security/authentication model

• User authentication typically via Microsoft Entra ID.
• Authorization is enforced via Azure DevOps security groups/permissions at org/project/repo/branch level.
• Git authentication options:
• SSH with uploaded public keys
• HTTPS with PATs (or other supported credential mechanisms; verify current recommended approach in official docs)

Networking model

• Azure Repos (Azure DevOps Services) is accessed over the public internet via HTTPS/SSH endpoints.
• Network restrictions are typically enforced via:
• Identity controls (MFA/conditional access)
• Organization policies
• Allowed IP restrictions features (availability may vary—verify in official docs for “IP allowlisting” and current configuration options)
• For strict private networking, organizations often use Azure DevOps Server (on-prem) rather than the SaaS.

Monitoring/logging/governance considerations

• Audit logs (where available) support security investigations and compliance.
• Repository events are visible via PR history, commit history, and policy evaluation.
• For SIEM integration, you may rely on:
• Azure DevOps audit logs export (capabilities vary—verify)
• Service hooks to forward events
• API-based extraction into Log Analytics/Sentinel (custom integration)

Simple architecture diagram (Mermaid)

flowchart LR
  Dev[Developer Git Client] -->|SSH/HTTPS push| Repos[Azure Repos]
  Dev -->|Create PR| Repos
  Repos -->|PR policy: build validation| Pipes[Azure Pipelines]
  Pipes -->|Status back to PR| Repos
  Reviewer[Reviewer] -->|Approve PR| Repos
  Repos -->|Merge to main| Repos

Production-style architecture diagram (Mermaid)

flowchart TB
  subgraph Corp[Enterprise Environment]
    Dev1[Dev Workstation]
    Dev2[Dev Workstation]
    Sec[Security Team]
  end

  subgraph Entra[Microsoft Entra ID]
    CA[Conditional Access + MFA]
    Groups[Users/Groups]
  end

  subgraph ADO[Azure DevOps Organization]
    Proj[Azure DevOps Project]
    Repos[Azure Repos (Git)]
    Policies[Branch Policies]
    Boards[Azure Boards]
    Hooks[Service Hooks]
  end

  subgraph CI[CI System]
    Pipes[Azure Pipelines]
    Agent[Self-hosted or Microsoft-hosted Agent]
    Artifacts[Build Artifacts/Packages]
  end

  subgraph Ops[Operations & Governance]
    Audit[Audit Logs]
    SIEM[SIEM/Sentinel via export or custom ingestion]
  end

  Dev1 -->|Auth| CA
  Dev2 -->|Auth| CA
  CA --> Groups
  Groups --> ADO

  Dev1 -->|Git push/PR| Repos
  Dev2 -->|Review/Approve| Repos
  Policies --> Repos

  Repos -->|Link commits/PRs| Boards
  Repos -->|Trigger validation| Pipes
  Pipes --> Agent --> Artifacts
  Pipes -->|Status checks| Repos

  Hooks -->|Notify| Ops
  ADO --> Audit --> SIEM
  Sec -->|Review access/policies| Policies

8. Prerequisites

To follow the hands-on lab safely and realistically, you need:

Account / project / tenancy requirements

• An Azure DevOps organization (Azure DevOps Services)
• Create/Access: https://dev.azure.com/
• A project within the organization (we’ll create one in the lab)

Permissions / IAM roles

• You need permission to:
• Create a project (or be a Project Collection Administrator / Organization owner equivalent)
• Create a Git repo (Project Administrator or repo-creation permission)
• Manage branch policies (typically requires specific permissions; in many orgs, Project Administrators can do this)

If you don’t have these permissions, ask your Azure DevOps admin to: – Create the project and repo for you, and/or – Grant you permissions to manage repos and policies for this lab

Billing requirements

Azure Repos is part of Azure DevOps licensing. For many small labs: – You can often use the free tier / free users (see Pricing section). – Build validation with Azure Pipelines may have parallel job/minutes considerations—keep the pipeline minimal.

Tools needed

Install these on your workstation: – Git (latest stable) – Verify: git --version – Optional but recommended: – Azure CLI (az) – Azure DevOps CLI extension (azure-devops) – A code editor (VS Code recommended)

Azure DevOps CLI documentation (verify latest):
https://learn.microsoft.com/azure/devops/cli/?view=azure-devops

Region availability / data residency

• Azure DevOps Services is global SaaS with organization-level “location/geography” choices.
• Choose the appropriate location when creating the organization. Changing later can be non-trivial—verify current migration options in official docs.

Quotas / limits (important to know)

Azure Repos has practical limits such as: – Max file sizes, push sizes, repo size guidance – API rate limits – Branch policy evaluation constraints

Limits change over time—use official docs for current values:
https://learn.microsoft.com/azure/devops/repos/?view=azure-devops

Prerequisite services

• None required for basic Git hosting.
• For build validation, you need Azure Pipelines in the same organization/project.

9. Pricing / Cost

Azure Repos does not typically have a “standalone per-repo” price. Cost is primarily driven by Azure DevOps pricing and usage.

Current pricing model (high-level)

Azure DevOps Services pricing is generally based on: – User access levels (e.g., Basic, Stakeholder, and add-ons like Test Plans) – Azure Pipelines usage (parallel jobs, hosted minutes—rules vary by plan and may change) – Potential storage-related costs in adjacent services (artifacts, packages), depending on what you use

Because Azure Repos is part of Azure DevOps, your effective cost depends on: – How many users need Basic access to contribute code – Whether you use additional paid features (e.g., test plans) – Whether you use pipelines heavily for PR validation

Official pricing page (use this as source of truth):
https://azure.microsoft.com/pricing/details/devops/
Also use the Azure Pricing Calculator when applicable:
https://azure.microsoft.com/pricing/calculator/

Free tier / low-cost entry

Commonly advertised Azure DevOps offers include: – A number of free users for Basic access (often first 5 users free for private projects) and Stakeholder access for unlimited users (feature-limited).
Because offerings can change, verify the current free-tier details on the official pricing page.

Pricing dimensions to consider

Dimension	What drives cost	How Azure Repos relates
User licensing	Number of contributors needing Basic access	Directly impacts who can contribute to repos
CI/CD compute	Hosted build minutes / parallel jobs	Build validation policies can increase pipeline runs
Storage	Repo size and related storage (Git LFS, artifacts, packages)	Large binaries can push you toward LFS or external storage
Admin overhead	Time spent managing access/policies	Not billed directly, but real operational cost

Cost drivers (direct and indirect)

Direct/plan-driven: – Number of Basic users who need to clone/push/PR – If PR validation uses Azure Pipelines heavily, the number of CI runs increases with PR activity

Indirect/hidden: – Repository bloat (large binaries in Git history) increases clone/fetch time and developer productivity cost – Compliance overhead (audits, access reviews) – Self-hosted agents (VM costs) if you choose them for build validation

Network/data transfer implications

• Git operations are internet-based for Azure DevOps Services.
• Data egress charges are not typically billed like Azure VNet egress because Azure DevOps Services is SaaS, but your corporate network may have bandwidth considerations.
• If using self-hosted agents in Azure, your agent VM networking and egress can incur Azure costs.

How to optimize cost

• Keep the number of Basic users aligned with actual contributors; use Stakeholder access for read-only/light users when appropriate.
• Minimize unnecessary CI runs:
• Use path filters in pipelines
• Validate only on key branches or PRs
• Keep repos healthy:
• Avoid committing large binaries
• Use Git LFS where appropriate (and understand its limits)
• Split extremely large repos if they hurt productivity

Example low-cost starter estimate (no fabricated numbers)

A typical “starter” setup: – One Azure DevOps organization – One project with one Git repo – Up to a small team using free/basic entitlements (if available on your plan) – Minimal pipelines (optional)

Cost outcome: Often near-zero for very small teams if you fit within the free tier; otherwise driven by per-user licensing.
Action: Confirm your exact entitlement and pricing on the official Azure DevOps pricing page.

Example production cost considerations

In production enterprise usage: – Hundreds to thousands of contributors (licensing is the largest predictable cost) – Mandatory PR validation builds (pipeline usage scales with PR volume) – Possible self-hosted agents for network access, compliance, or performance (VMs + maintenance) – Ongoing governance: access reviews and audits

Recommendation: Build a cost model using: – number of contributor identities (Basic vs Stakeholder) – expected PR volume and validation runs/day – self-hosted vs Microsoft-hosted agent strategy
Then validate assumptions with the official pricing pages and your Microsoft agreement.

10. Step-by-Step Hands-On Tutorial

This lab walks you through creating a Git repo in Azure Repos, cloning it securely, using a PR workflow, and enforcing a basic branch policy. The steps are designed to be beginner-friendly, low-cost, and realistic.

Objective

• Create an Azure DevOps project and an Azure Repos Git repository
• Clone via SSH (or HTTPS), commit code, push a feature branch
• Open a pull request and merge into main
• Add a branch policy to protect main
• (Optional but recommended) Add build validation using Azure Pipelines

Lab Overview

You will build this workflow: 1. Create organization/project/repo 2. Configure authentication (SSH key or PAT) 3. Clone repo locally 4. Add a small sample app and tests 5. Push a feature branch 6. Create PR and merge 7. Configure branch policy (minimum reviewers) 8. Optional: add CI build validation policy

Step 1: Create or access your Azure DevOps organization

1. Go to: https://dev.azure.com/
2. Sign in with your Microsoft Entra ID (work/school) or Microsoft account (if allowed).
3. If you don’t have an organization: – Create one and choose the organization name. – Choose the location/region offered (data residency considerations).

Expected outcome: You can access your Azure DevOps organization landing page at: https://dev.azure.com/<your-organization-name>

Step 2: Create a new project

1. In Azure DevOps, select New project
2. Name: azure-repos-lab
3. Visibility: Private (recommended for learning realistic governance)
4. Version control: Git
5. Work item process: Agile (default is fine)

Expected outcome: Project is created and you can see left navigation including Repos.

Step 3: Create a new Git repo in Azure Repos

1. In the project, go to Repos
2. From the repo selector (top-left), choose New repository
3. Repo name: sample-app
4. Type: Git

Expected outcome: Azure Repos shows the repo page with clone instructions and an empty repo (or initialized option depending on UI).

Step 4: Configure authentication (choose SSH or HTTPS)

You can use either:

Option A (recommended): SSH authentication

1. On your machine, generate an SSH key pair (if you don’t already have one):

ssh-keygen -t ed25519 -C "azure-repos-lab"
# Press Enter to accept default file path, optionally set a passphrase.

2. Display your public key:

cat ~/.ssh/id_ed25519.pub

3. In Azure DevOps: – Go to User settings (top-right) → SSH public keys – Add the public key

4. Test SSH connectivity (Azure DevOps will provide a hostname; follow the clone URL shown in the portal). For many setups, the SSH URL looks like: git@ssh.dev.azure.com:v3/<org>/<project>/<repo> Use the exact URL from your repo’s Clone dialog.

Expected outcome: SSH key is added to your Azure DevOps profile.

Option B: HTTPS with a Personal Access Token (PAT)

If SSH is blocked in your environment, use HTTPS with a PAT: 1. In Azure DevOps, go to User settings → Personal access tokens 2. Create a new token: – Scope: limit to Code (Read & Write) for least privilege – Expiration: short (e.g., 7–30 days) for lab usage 3. Use your PAT as the password when Git prompts.

Expected outcome: You can authenticate Git operations using HTTPS + PAT.

Security note: Treat PATs like passwords. Do not store them in code or share them.

Step 5: Clone the repo locally

Copy the clone URL from Repos → Clone and run:

SSH example

mkdir -p ~/dev/azure-repos-lab
cd ~/dev/azure-repos-lab

git clone git@ssh.dev.azure.com:v3/<ORG>/<PROJECT>/sample-app
cd sample-app

HTTPS example

git clone https://dev.azure.com/<ORG>/<PROJECT>/_git/sample-app
cd sample-app

Expected outcome: You have a local sample-app folder with a .git directory:

ls -la

Step 6: Add a tiny sample app + tests and commit to a feature branch

Create a simple Python project structure:

mkdir -p app tests
cat > app/calculator.py <<'EOF'
def add(a, b):
    return a + b
EOF

cat > tests/test_calculator.py <<'EOF'
from app.calculator import add

def test_add():
    assert add(2, 3) == 5
EOF

cat > requirements.txt <<'EOF'
pytest
EOF

cat > README.md <<'EOF'
# sample-app

Small sample app for Azure Repos lab.

## Run tests
pip install -r requirements.txt
pytest -q
EOF

Create a feature branch, commit, and push:

git checkout -b feature/add-calculator
git add .
git commit -m "Add calculator module and unit test"
git push -u origin feature/add-calculator

Expected outcome: The branch feature/add-calculator appears in Azure Repos under Branches, and the commit shows in the repo history.

Step 7: Create a pull request (PR)

1. In Azure DevOps, go to Repos → Pull requests
2. Select New pull request
3. Source: feature/add-calculator
4. Target: main (or the default branch shown)
5. Title: Add calculator module
6. Add a reviewer (if you have another user). If you’re alone, you can still create PR but approval policies may be limited by your org settings.

Expected outcome: PR is created, showing files changed and discussion area.

Step 8: Complete (merge) the PR

1. Review the changes in the PR “Files” tab
2. Add a comment (optional) and resolve it (to learn the UI)
3. If no branch policies block you: – Select Complete – Choose a merge strategy offered (merge commit/squash/rebase options depend on settings; choose what aligns with your team norms)

Expected outcome: Changes are merged into main. The main branch now contains app/, tests/, and README.md.

Verify locally:

git checkout main
git pull
pytest -q

Step 9: Protect main with a basic branch policy (minimum reviewers)

Now enforce a real governance control.

1. Go to Repos → Branches
2. Find main, select the … menu → Branch policies
3. Configure: – Minimum number of reviewers: 1 (or 2 in real teams) – Optional: Check for linked work items – Optional: Check for comment resolution

Expected outcome: Future PRs into main require the minimum number of approvals (as configured), and optional checks are enforced.

If you’re the only user, you may not be able to satisfy minimum-reviewer policies without adjusting settings. In a real org, you’d rely on team reviewers or group rules.

Step 10 (Optional but recommended): Add build validation with Azure Pipelines

This step connects Azure Repos to a CI check.

1. Go to Pipelines → Pipelines
2. Select Create Pipeline
3. Choose Azure Repos Git
4. Select sample-app
5. Choose Starter pipeline or Python package template if offered
6. Use this minimal YAML (adjust Python version if required):

trigger:
  branches:
    include:
      - main

pr:
  branches:
    include:
      - main

pool:
  vmImage: ubuntu-latest

steps:
  - task: UsePythonVersion@0
    inputs:
      versionSpec: '3.x'

  - script: |
      python -m pip install --upgrade pip
      pip install -r requirements.txt
    displayName: Install dependencies

  - script: |
      pytest -q
    displayName: Run unit tests

7. Save and run.

Now connect it to branch policy: 1. Go back to Repos → Branches → main → Branch policies 2. Under Build validation, add a build policy referencing the pipeline you created 3. Configure: – Trigger: Automatic – Policy requirement: Required

Expected outcome: New PRs targeting main must pass the pipeline before merge is allowed.

Validation

Use this checklist to confirm everything works:

1. Repo exists and can be cloned – git clone ... works without auth failures
2. Feature branch workflow works – Branch exists in Azure Repos – PR can be created
3. Branch policy works – A new PR to main shows policy checks
4. Build validation works (if enabled) – PR shows a build check – The pipeline runs and reports pass/fail back to PR

Create a breaking change to validate enforcement:

git checkout -b feature/break-test
echo "def add(a, b): return a - b" > app/calculator.py
git commit -am "Break add() intentionally"
git push -u origin feature/break-test

Open a PR to main. The build should fail and block completion.

Troubleshooting

Common problems and realistic fixes:

1. Git authentication fails (SSH) – Symptom: Permission denied (publickey). – Fix:

   • Ensure the correct public key is uploaded to Azure DevOps.
   • Ensure your SSH agent has the key loaded: bash eval "$(ssh-agent -s)" ssh-add ~/.ssh/id_ed25519
   • Use the exact clone URL from Azure Repos.

2. Git authentication fails (HTTPS) – Symptom: repeated password prompts or 401/403 errors. – Fix:

   • Use a PAT as the password, not your normal account password.
   • Ensure PAT scope includes Code (Read & Write).
   • Ensure PAT is not expired.

3. Cannot complete PR due to policies – Symptom: PR completion blocked. – Fix:

   • Satisfy reviewers requirement (add reviewers, get approvals).
   • If alone, temporarily reduce minimum reviewers for the lab.
   • Fix build failures shown in the policy checks.

4. Pipeline doesn’t run on PR – Symptom: PR created but no validation build appears. – Fix:

   • Confirm YAML includes pr: trigger.
   • Confirm build validation policy is attached to the correct branch.
   • Confirm pipeline permissions allow it to access the repo (project settings).

5. Python tests fail in pipeline but pass locally – Symptom: dependency or path issues. – Fix:

   • Ensure requirements.txt is committed.
   • Keep pipeline commands simple; run from repo root.
   • Confirm line endings and file paths.

Cleanup

To avoid ongoing overhead:

1. Delete the project (fastest cleanup) – Azure DevOps → Project settings → Delete project
2. Or delete repo and pipeline individually: – Repos → repo settings → delete repo – Pipelines → delete pipeline
3. Revoke credentials: – Delete the PAT (if created) – Optionally remove SSH key from Azure DevOps user settings

11. Best Practices

Architecture best practices

• Separate repos by lifecycle and ownership: Prefer one repo per service/team unless monorepo is a deliberate platform decision.
• Use templates: Standardize repo structure (README, CODEOWNERS-like approach via required reviewers, SECURITY.md, pipeline YAML).
• Trunk-based development (common): Keep main always releasable; use short-lived feature branches and PRs.

IAM/security best practices

• Use Entra ID groups mapped to Azure DevOps groups; avoid individual permission assignments.
• Apply least privilege:
• Most contributors: no force push, no direct push to main
• Only a small admin group can manage permissions and bypass policies
• Prefer SSH keys for developer machines; limit PAT usage and scope.
• Enforce MFA and conditional access at the tenant level where appropriate.

Cost best practices

• Keep repo sizes manageable (don’t store build outputs, dependencies, binaries).
• Use CI judiciously:
• PR validation for critical branches
• Path filters to avoid running full pipelines on doc-only changes
• Avoid redundant pipelines for the same checks across many repos; use reusable templates where possible.

Performance best practices

• Keep PRs small and frequent.
• Avoid rewriting published history (force pushes) on shared branches.
• For large repos, standard Git performance practices apply:
• Reduce binary churn
• Consider splitting repos or using sparse checkout (client-side) if appropriate

Reliability best practices

• Protect main with:
• Minimum reviewers
• Build validation
• Comment resolution
• Use branch naming conventions and retention policies to reduce clutter.
• Treat branch policies as production controls; change them via controlled admin processes.

Operations best practices

• Regularly review:
• Stale branches
• Repo permissions (effective permissions)
• PAT inventory and expiration policies
• Implement audit log review procedures for sensitive projects.
• Establish a “break glass” admin process for urgent production fixes (and log its use).

Governance / tagging / naming best practices

Azure DevOps doesn’t use Azure resource tags for repos, but you can standardize: – Organization and project naming: org-division-platform, proj-app-payments – Repo naming: service-payments-api, infra-networking, lib-shared-auth – Branch naming: feature/<ticket>-short-desc, hotfix/<ticket>-desc – Policy baselines: define “gold standard” branch policies for production repos

12. Security Considerations

Identity and access model

• Authentication: Typically through Microsoft Entra ID.
• Authorization: Azure DevOps permissions model with org/project/repo/branch scopes.
• Use groups for role-based access (Developers, Maintainers, Admins).

Encryption

• Data is encrypted in transit using HTTPS/SSH.
• Data at rest encryption is handled by the service (SaaS). For details and compliance specifics, verify in official Azure DevOps security documentation.

Network exposure

• Azure DevOps Services endpoints are internet accessible.
• Use tenant-level conditional access (MFA, compliant devices) to reduce risk.
• If you require strict private network access, evaluate Azure DevOps Server (on-prem) instead of SaaS.

Secrets handling

• Do not store secrets in repositories.
• Use:
• Azure Key Vault (commonly) with pipelines
• Pipeline secret variables/variable groups (with appropriate protections)
• Add pre-commit hooks or pipeline secret scanning (tooling choice varies) to prevent credential leaks.

Audit/logging

• Use Azure DevOps audit logs (availability and retention depend on your plan—verify).
• Monitor:
• Permission changes
• PAT creation
• Policy bypass events (if allowed)
• Repo deletion events

Compliance considerations

• Data residency: choose correct organization location/geography at creation time.
• Retention: define policies for repos and PR history if required by regulation (and confirm capabilities in docs).
• Separation of duties: enforce approvals and restrict who can bypass policies.

Common security mistakes

• Allowing direct pushes to main
• Broad “Project Administrators” membership
• PATs with wide scopes and long lifetimes
• Storing secrets in code or wiki pages
• Unreviewed service hooks sending data to third parties

Secure deployment recommendations

• Protect main and release branches with strict policies.
• Enforce least privilege and group-based access.
• Use build validation to ensure CI checks always run.
• Regularly rotate PATs and remove unused SSH keys.
• Implement an incident response playbook for leaked credentials (revoke PATs/keys, rotate secrets, audit repo history).

13. Limitations and Gotchas

Azure Repos is mature, but these issues commonly surprise teams:

Known limitations / practical constraints

• Repo size and performance: Git can degrade with very large histories or binary-heavy repos. Use Git LFS and good hygiene.
• Binary storage: Git is not an artifact repository. Don’t store build outputs; use proper artifact/package storage.
• Policy overhead: Too many required checks can slow development; design policies intentionally.

Quotas

• File size limits, push limits, repo recommendations, and API rate limits exist and change over time.
  Use official documentation for current limits: https://learn.microsoft.com/azure/devops/repos/?view=azure-devops

Regional constraints / data residency

• Organization location choice matters for compliance and latency.
• Changing organization location can be complex—verify current supported migration approach.

Pricing surprises

• Azure Repos itself is usually bundled, but:
• Adding many contributors increases user licensing costs.
• Enforcing PR build validation increases CI runs, potentially increasing pipeline costs or requiring more self-hosted capacity.

Compatibility issues

• Some Git client behaviors differ by credential manager and OS.
• Corporate proxies/firewalls can block SSH; you may need HTTPS + PAT.

Operational gotchas

• Permission inheritance can lead to accidental access grants.
• Policy bypass settings can undermine governance if broadly granted.
• Repo deletion is destructive; ensure deletion permissions are restricted and recovery procedures are understood (verify restore options in docs).

Migration challenges

• Migrating from TFVC to Git requires careful planning (history, branches, large files).
• Migrating from other Git hosts requires mapping:
• Users/groups
• Webhooks/service hooks
• Branch protections to Azure Repos policies

14. Comparison with Alternatives

Azure Repos is one option among several source control platforms.

Comparison table

Option	Best For	Strengths	Weaknesses	When to Choose
Azure Repos (Azure DevOps)	Teams using Azure DevOps end-to-end	Strong branch policies, PR workflow, integrated Pipelines/Boards, enterprise controls	Smaller ecosystem than GitHub; SaaS private networking constraints	You want integrated Azure DevOps workflows and strong governance
GitHub (Microsoft)	Open-source-centric and broad ecosystem	Huge community, marketplace apps, excellent collaboration, GitHub Actions	Some enterprises prefer Azure DevOps project structure; governance model differs	You want best-in-class Git hosting ecosystem and broad integrations
GitLab (SaaS/self-managed)	Single platform with SCM + CI/CD + security	Strong all-in-one DevSecOps features, self-managed option	Can require more admin effort when self-managed	You want integrated SCM+CI+security and possibly self-hosting
Bitbucket (Atlassian)	Atlassian-centric teams	Good Jira integration, familiar workflows	CI/CD via other Atlassian tools; ecosystem differences	You’re standardized on Jira/Confluence and prefer Atlassian tooling
Azure DevOps Server (on-prem)	Private network + compliance	Full control, on-prem hosting	You manage infrastructure and upgrades; licensing/ops overhead	You require on-prem source control and cannot use SaaS
Self-managed Git (Gitea/Git server)	Small teams, custom needs	Low cost, high control	You own security, backup, HA, scaling	You need full control and accept operational burden

15. Real-World Example

Enterprise example: Regulated payments platform

• Problem: A payments company must enforce peer review, CI validation, and traceability for every change that reaches production.
• Proposed architecture:
• Azure DevOps Organization with separate projects per business domain
• Azure Repos Git repos per microservice
• Branch policies on main:
  • 2 required reviewers
  • Linked work item required
  • Build validation required (unit tests + SAST in pipeline)
• Azure Pipelines for CI; deployments handled downstream (release pipelines or multi-stage YAML)
• Audit log reviews integrated into SOC processes (export/integration approach verified per org capabilities)
• Why Azure Repos was chosen:
• Strong policy enforcement and integrated PR+pipeline experience
• Works well with enterprise identity and governance model
• Expected outcomes:
• Fewer production incidents caused by unreviewed changes
• Audit-ready evidence: who approved, what tests ran, and what was merged
• Consistent developer workflow across many teams

Startup/small-team example: SaaS MVP with lightweight governance

• Problem: A small team needs reliable Git hosting and PR workflow without managing infrastructure.
• Proposed architecture:
• One Azure DevOps project
• One repo for backend + one repo for infra
• Simple branch policies: 1 reviewer + PR build validation for main
• Minimal pipeline runs to control cost
• Why Azure Repos was chosen:
• The team already uses Azure DevOps Boards and wants a single tool
• Free/low-cost starting point depending on current entitlements (verify)
• Expected outcomes:
• Predictable workflow, fewer “broken main” incidents
• Quick onboarding for new hires
• Controlled costs while scaling development practices

16. FAQ

1) Is Azure Repos the same as Azure DevOps?

Azure Repos is a component of Azure DevOps. Azure DevOps includes Repos (source control), Pipelines (CI/CD), Boards (work tracking), Artifacts (packages), and Test Plans.

2) Does Azure Repos support Git?

Yes. Azure Repos primarily provides hosted Git repositories. It also supports TFVC for centralized version control.

3) Can I use SSH with Azure Repos?

Yes. You can upload SSH public keys to your Azure DevOps profile and clone/push using SSH.

4) Can I use HTTPS instead of SSH?

Yes. HTTPS is supported. For non-interactive access, PATs are commonly used (verify current recommended auth methods in docs).

5) Are there branch protection features like “required reviews”?

Yes. Azure Repos supports branch policies such as minimum reviewers, build validation, linked work items, and more.

6) Can Azure Repos require CI checks before merging?

Yes. Using branch policies, you can require build validation from Azure Pipelines.

7) Does Azure Repos have a “CODEOWNERS” feature?

Azure Repos uses required reviewers and branch policies to approximate code ownership. Exact parity with GitHub’s CODEOWNERS behavior may differ—verify current feature support in docs.

8) Can I mirror repos from GitHub/GitLab into Azure Repos?

Git supports mirroring patterns, but implementation is typically done via pipelines or external automation. Capabilities and best practices vary—verify current official guidance for migration/mirroring.

9) Is Azure Repos suitable for monorepos?

It can be, but monorepos require discipline: – Build path filters – Repo performance management – Clear ownership and policies
For very large monorepos, test performance and workflow carefully.

10) What’s the difference between Azure Repos and GitHub?

Both host Git repositories. Azure Repos is designed around Azure DevOps project structure and policies. GitHub has a larger ecosystem and open-source collaboration features. Choose based on your toolchain and governance needs.

11) How do I manage access to repos?

Use Azure DevOps permissions and groups. Prefer group-based access and least privilege. Restrict force push and direct pushes to protected branches.

12) Can I enforce work item linking for PRs?

Yes, branch policies can enforce linking work items (where configured).

13) How do I avoid committing secrets?

Use secret stores (Key Vault), pipeline secret variables, and add scanning in pipelines. Also train developers and use pre-commit hooks.

14) Does Azure Repos support large files?

Git is not ideal for large binaries. Use Git LFS where appropriate and keep binaries out of the main Git history. Confirm current LFS limits in official docs.

15) Can I use Azure Repos without Azure Pipelines?

Yes. You can use Azure Repos alone for source control. CI/CD can be done with other tools, but integration is simplest with Azure Pipelines.

16) Is Azure Repos available on-premises?

Azure Repos functionality is available as part of Azure DevOps Server (self-hosted). That is a separate deployment and licensing model.

17) How do I back up Azure Repos?

For Azure DevOps Services (SaaS), Microsoft manages service availability. For additional assurance, some teams maintain mirrors/exports. For on-prem Azure DevOps Server, you must implement backups yourself. Verify current guidance for backup/export approaches.

17. Top Online Resources to Learn Azure Repos

Resource Type	Name	Why It Is Useful
Official documentation	Azure DevOps Repos docs: https://learn.microsoft.com/azure/devops/repos/?view=azure-devops	Central hub for Git/TFVC, PRs, and repo management
Official documentation	Azure Repos Git tutorial (start here within Repos docs): https://learn.microsoft.com/azure/devops/repos/git/?view=azure-devops	Git workflows, branching, PRs, and common tasks
Official documentation	Set branch policies (Azure Repos): https://learn.microsoft.com/azure/devops/repos/git/branch-policies?view=azure-devops	How to implement protected branches correctly
Official documentation	Pull requests in Azure Repos: https://learn.microsoft.com/azure/devops/repos/git/pull-requests?view=azure-devops	PR lifecycle, reviews, and collaboration
Official documentation	Azure DevOps CLI: https://learn.microsoft.com/azure/devops/cli/?view=azure-devops	Automate repo/project tasks and standardize setup
Official pricing	Azure DevOps pricing: https://azure.microsoft.com/pricing/details/devops/	Source of truth for user licensing and plan costs
Official tool	Azure Pricing Calculator: https://azure.microsoft.com/pricing/calculator/	Helps estimate related Azure costs (agents/VMs/etc.)
Official documentation	Azure Pipelines YAML schema (for validation builds): https://learn.microsoft.com/azure/devops/pipelines/yaml-schema/?view=azure-pipelines	Build validation requires pipelines; YAML reference helps
Official videos	Azure DevOps YouTube (Microsoft DevOps content): https://www.youtube.com/results?search_query=Microsoft+Azure+DevOps+Repos	Quick demos and scenario-based walkthroughs (verify channel/source)
Community learning	Microsoft Learn (Azure DevOps learning paths): https://learn.microsoft.com/training/	Structured learning modules; search for Azure DevOps and Repos topics

18. Training and Certification Providers

(Neutral listing; verify schedules, pricing, and course outlines on each website.)

Institute	Suitable Audience	Likely Learning Focus	Mode	Website URL
DevOpsSchool.com	Beginners to working DevOps engineers	Azure DevOps fundamentals, repos/CI/CD practices	Check website	https://www.devopsschool.com/
ScmGalaxy.com	Developers, build/release engineers	Source control and SCM best practices, DevOps tooling	Check website	https://www.scmgalaxy.com/
CLoudOpsNow.in	Cloud/ops teams	Cloud operations + DevOps workflows	Check website	https://cloudopsnow.in/
SreSchool.com	SREs, platform engineers	Reliability-focused DevOps practices, automation	Check website	https://sreschool.com/
AiOpsSchool.com	Ops/platform teams exploring AIOps	Operations automation concepts and tooling overview	Check website	https://aiopsschool.com/

19. Top Trainers

(Provided as training resources/platforms; verify specific trainer profiles and offerings on each site.)

Platform/Site	Likely Specialization	Suitable Audience	Website URL
RajeshKumar.xyz	DevOps coaching and guidance topics (verify offerings)	Beginners to intermediate DevOps learners	https://rajeshkumar.xyz/
devopstrainer.in	DevOps training content and workshops (verify)	Individuals and teams	https://devopstrainer.in/
devopsfreelancer.com	Freelance DevOps help/training resources (verify)	Teams needing short-term assistance	https://devopsfreelancer.com/
devopssupport.in	DevOps support and enablement (verify)	Ops/DevOps teams	https://devopssupport.in/

20. Top Consulting Companies

(Neutral descriptions without claims about specific clients, awards, or certifications.)

Company	Likely Service Area	Where They May Help	Consulting Use Case Examples	Website URL
cotocus.com	DevOps and cloud consulting (verify scope)	DevOps process setup, CI/CD, platform enablement	Azure DevOps organization setup; repo governance standards; PR/policy rollout	https://cotocus.com/
DevOpsSchool.com	DevOps consulting and training (verify scope)	Toolchain implementation, upskilling, delivery practices	Azure Repos branching strategy; pipeline integration for PR validation; access control design	https://www.devopsschool.com/
DEVOPSCONSULTING.IN	DevOps consulting services (verify scope)	Process improvement and DevOps tooling	Migration planning to Azure Repos; policy baselines; automation via CLI/APIs	https://devopsconsulting.in/

21. Career and Learning Roadmap

What to learn before Azure Repos

• Git fundamentals: commits, branches, merges, rebase, conflict resolution
• Code review basics: small PRs, review etiquette, approval standards
• Identity basics: Entra ID users/groups, least privilege concepts

What to learn after Azure Repos

• Azure Pipelines: CI/CD pipelines, PR validation, release strategies
• DevSecOps: secret scanning, dependency scanning, SAST/DAST integration (often via pipelines)
• Infrastructure as Code: Bicep/Terraform repo patterns, environment promotion
• Governance at scale: policy templates, automation with Azure DevOps CLI/REST APIs, audit readiness

Job roles that use Azure Repos

• Software Engineer / Senior Engineer
• DevOps Engineer
• SRE / Platform Engineer
• Build and Release Engineer
• Security Engineer (DevSecOps)
• Cloud Solutions Architect (governance and toolchain design)

Certification path (if available)

Azure Repos itself is not a standalone certification topic, but it’s commonly part of: – Azure DevOps learning paths – DevOps Engineer-oriented certifications and training tracks
Check Microsoft Learn and current certification listings (they change over time):
https://learn.microsoft.com/credentials/

Project ideas for practice

1. Branch policy baseline project: Implement policies for main and release/* and document rationale.
2. Repo template automation: Use Azure DevOps CLI/REST to create repos with default README, pipeline YAML, and policies.
3. IaC governance repo: Terraform/Bicep repo with PR validation (format/lint/plan) and approval gates.
4. Monorepo experiment: Create a monorepo with path-filtered pipelines and evaluate performance.
5. Migration simulation: Migrate a GitHub repo to Azure Repos preserving branches and tags; document mapping.

22. Glossary

• Azure DevOps Organization: The top-level container for Azure DevOps Services, holding projects, users, and settings.
• Project: A logical container within an organization for repos, pipelines, boards, and permissions.
• Azure Repos: Azure DevOps source control service providing Git repos and TFVC.
• Git: Distributed version control system used for source code management.
• TFVC: Team Foundation Version Control, a centralized version control system supported in Azure DevOps.
• Repository (repo): A Git or TFVC codebase with history.
• Commit: A snapshot of changes recorded in Git.
• Branch: A pointer to a line of development in Git.
• Pull Request (PR): A request to merge changes from one branch into another with review.
• Branch Policy: Rules enforced on a branch (e.g., approvals, build validation).
• Build validation: A policy requiring a CI build/test pipeline to succeed before merging.
• PAT (Personal Access Token): A token used for authentication (commonly over HTTPS) with scoped permissions.
• SSH key: Public/private key pair used for secure authentication (commonly for Git over SSH).
• Least privilege: Security principle of granting only the minimal permissions needed.
• Service hook: Event-based integration sending notifications or triggering actions in external systems.
• Trunk-based development: Workflow where developers integrate frequently to a main branch with short-lived branches.

23. Summary

Azure Repos is Azure DevOps’s source control service for hosting Git repositories (and TFVC where needed) with strong pull request workflows and branch policies that enforce reviews and quality gates. It matters because it turns source control into a governed, auditable process—especially when integrated with Azure Pipelines for PR build validation and Azure Boards for traceability.

From an architecture standpoint, Azure Repos is project-scoped within an Azure DevOps organization, integrates tightly with the broader DevOps toolchain, and relies on Entra ID plus Azure DevOps permissions for access control. Cost is typically driven by Azure DevOps user licensing and CI usage rather than per-repo charges, so keep an eye on contributor counts, pipeline validation frequency, and repository health. Security best practice is to protect main with policies, minimize PAT usage, and enforce least privilege with group-based permissions.

Use Azure Repos when you want a managed Git service tightly integrated with Azure DevOps planning and CI/CD. Next step: expand the lab by standardizing branch policies across repos and implementing PR validation pipelines with reusable YAML templates (and confirm your plan’s entitlements on the official Azure DevOps pricing page).