Design and implement quality and release gates

Gates live at two different boundaries, and confusing them is the usual mistake.

Boundary	Mechanism	Owner
Pull-request completion into a branch	Branch policies	Project Administrators or users with repository-level Edit policies permission
Use of a protected resource	Approvals and checks	Resource owner

Branch policies — the merge gate

Applied to a protected branch, these can require: a minimum number of reviewers, linked work items, resolved comments, successful build validation, and successful status checks from external services. They enforce those requirements before a pull request completes.

What they cannot do is govern deployment. A branch policy has no opinion about whether a release may reach production.

Checks — the protected-resource gate

Configured by the owner of an environment, service connection, repository, agent pool, variable group, or secure file. Because the resource owner sets them outside pipeline YAML, a central team can impose a control on any stage that consumes the protected resource.

The security-and-governance examples worth naming:

Required template — requires pipelines that use the protected resource or environment to extend the specified template.
Branch control — checks the branches of all linked resources against the allowed list and can require branch protection.
Query Azure Monitor alerts — succeeds when no queried alert rules are active at evaluation time.
Evaluate artifact — applies custom policy to artifact metadata; it currently supports container image artifacts only.

Shift left, but keep the gate

Fast feedback in the PR is cheaper than a failed release, so run unit tests, linting and dependency scanning at the merge boundary. Keep protected-resource checks as well. A configured branch policy enforces its PR requirements; configured checks enforce whether a stage may consume a protected resource. Neither mechanism proves general code quality by itself.

Primary sources

Design and implement quality and release gates

Gates live at two different boundaries, and confusing them is the usual mistake.

Boundary	Mechanism	Owner
Pull-request completion into a branch	Branch policies	Project Administrators or users with repository-level Edit policies permission
Use of a protected resource	Approvals and checks	Resource owner

Branch policies — the merge gate

What they cannot do is govern deployment. A branch policy has no opinion about whether a release may reach production.

Checks — the protected-resource gate

The security-and-governance examples worth naming:

Required template — requires pipelines that use the protected resource or environment to extend the specified template.
Branch control — checks the branches of all linked resources against the allowed list and can require branch protection.
Query Azure Monitor alerts — succeeds when no queried alert rules are active at evaluation time.
Evaluate artifact — applies custom policy to artifact metadata; it currently supports container image artifacts only.

Shift left, but keep the gate

Primary sources

Quality and release gates

Design and implement quality and release gates

Branch policies — the merge gate

Checks — the protected-resource gate

Shift left, but keep the gate

Quality and release gates

Design and implement quality and release gates

Branch policies — the merge gate

Checks — the protected-resource gate

Shift left, but keep the gate