Manage sensitive files during deployment

Some deployments need a file, not a string: a signing certificate, provisioning profile, keystore, or SSH key.

Secure files

The Azure Pipelines secure files library stores sensitive files encrypted on the server, outside the repository. Secure files are protected resources with approvals, checks, and pipeline permissions.

For YAML pipelines, authorize only the selected pipelines that require the file. All classic pipelines can access secure files, so a strict exclusivity requirement must also govern or disable classic pipeline use.

Do not commit private-key material merely because Git accepts binary files. Revoke or rotate an exposed certificate first. Ordinary deletion or rotation does not purge earlier Git objects; clones or forks may retain copies, and complete history cleanup requires coordination.

Cleaning up

DownloadSecureFile@1 deletes its managed download from the download location when the job finishes, whether it succeeds, fails, or is canceled. This applies on both Microsoft-hosted and self-hosted agents.

That contract does not cover copies made by scripts or installed artifacts. Manage those lifecycles explicitly. InstallAppleCertificate@2 always deletes a temporary keychain; certificates installed into default or custom keychains need the task's configured cleanup behavior.

A Microsoft-hosted job also receives a fresh VM that is discarded after the job. That provides broader isolation, but it is not what causes DownloadSecureFile@1 to clean its own download. Persistent self-hosted agents make explicit cleanup of derived copies especially important.

The value alternative

When a selected Key Vault secret is needed as a pipeline value, a Key Vault-linked variable group maps the secret name and fetches the latest value at runtime. It is one supported value mechanism, not the universal answer for every sensitive value. Nonsecret variables do not receive approvals, checks, or pipeline-permission protection.

Secure files remain the intended mechanism for genuine sensitive file artifacts.

Primary sources

• https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
• https://learn.microsoft.com/en-us/azure/devops/pipelines/library/secure-files?view=azure-devops
• https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/download-secure-file-v1?view=azure-pipelines
• https://learn.microsoft.com/en-us/azure/devops/pipelines/process/about-resources?view=azure-devops
• https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
• https://learn.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops
• https://learn.microsoft.com/en-us/azure/devops/pipelines/library/link-variable-groups-to-key-vaults?view=azure-devops
• https://learn.microsoft.com/en-us/azure/devops/repos/tfvc/comparison-git-tfvc?view=azure-devops
• https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops
• https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/install-apple-certificate-v2?view=azure-pipelines