Add & use variable groups

  • Article

TFS 2018

Variable groups store values and secrets that you might want to be passed into a YAML pipeline or make available across multiple pipelines. You can share and use variable groups in multiple pipelines in the same project.

Secret variables in Variables groups are protected resources. You can add combinations of approvals, checks, and pipeline permissions to limit access to secret variables in a variable group. Access to non-secret variables is not limited by approvals, checks, and pipeline permissions.

Note

Microsoft Visual Studio Team Foundation Server 2018 and earlier versions have the following differences in naming:

  • Pipelines for build and release are called definitions
  • Runs are called builds
  • Service connections are called service endpoints
  • Stages are called environments
  • Jobs are called phases

Create a variable group

You can't create variable groups in YAML, but they can be used as described in Use a variable group.

Use a variable group

YAML builds aren't available on TFS.

Access the variable values in a linked variable group the same way as variables you define within the pipeline itself. For example, to access the value of a variable named customer in a variable group linked to the pipeline, use $(customer) in a task parameter or a script. But, you can't access secret variables (encrypted variables and key vault variables) directly in scripts - instead, they must be passed as arguments to a task. For more information, see secrets

Changes that you make to a variable group are automatically available to all the definitions or stages to which the variable group gets linked.

Note

Key Vaults using Azure role-based access control (Azure RBAC) are not supported.

Link an existing Azure key vault to a variable group and map selective vault secrets to the variable group.

  1. In the Variable groups page, enable Link secrets from an Azure key vault as variables. You'll need an existing key vault containing your secrets. Create a key vault using the Azure portal.

    Screenshot of variable group with Azure key vault integration.

  2. Specify your Azure subscription end point and the name of the vault containing your secrets.

    Ensure the Azure service connection has at least Get and List management permissions on the vault for secrets. Enable Azure Pipelines to set these permissions by choosing Authorize next to the vault name. Or, set the permissions manually in the Azure portal:

    1. Open Settings for the vault, and then choose Access policies > Add new.
    2. Select Select principal and then choose the service principal for your client account.
    3. Select Secret permissions and ensure that Get and List have check marks.
    4. Select OK to save the changes.

  3. On the Variable groups page, select + Add to select specific secrets from your vault for mapping to this variable group.

Manage key vault secrets

See the following list of helpful tips for managing secrets.

  • Only the secret names get mapped to the variable group, not the secret values. The latest secret value, fetched from the vault, is used in the pipeline run that's linked to the variable group.

  • Any change made to existing secrets in the key vault is automatically available to all the pipelines the variable group's used in.

  • When new secrets get added to or deleted from the vault, the associated variable groups aren't automatically updated. The secrets included in the variable group must be explicitly updated so the pipelines that are using the variable group get executed correctly.

  • Azure Key Vault supports storing and managing cryptographic keys and secrets in Azure. Currently, Azure Pipelines variable group integration supports mapping only secrets from the Azure key vault. Cryptographic keys and certificates aren't supported.

Expand variables in a group

YAML isn't supported in TFS.