Choosing package management tools
Recommend package management tools
Azure Artifacts and GitHub Packages both host packages. Choose by package ecosystem, governance boundary, CI integration, and whether the organisation needs Azure Artifacts to retain dependencies from upstream registries.
| Decision signal | Azure Artifacts | GitHub Packages |
|---|---|---|
| Platform fit | Azure DevOps organisation- or project-scoped feed | GitHub-native hosting integrated with GitHub Actions, APIs, and webhooks |
| Formats | NuGet, npm, Maven, Python, Cargo, Universal Packages | npm, RubyGems, Maven, Gradle, NuGet, and Container registry for Docker/OCI images |
| Permissions | Feed Reader; Feed and Upstream Reader (Collaborator); Feed Publisher (Contributor); Feed Owner | Read/Write/Admin; package scope depends on the registry and can be user, organisation, or repository based |
The discriminator: upstream sources
When upstream sources are enabled, Azure Artifacts automatically saves a package installed from an upstream by a Feed and Upstream Reader (Collaborator) or higher. Once saved, that package version is immutable and remains in the feed even if the upstream is later disabled or removed.
That capability answers several exam scenarios at once:
- Reliability — a previously saved version remains retrievable during a temporary public-registry outage.
- Centralised inventory — the feed retains the versions and metadata installed through it.
- Package integrity — the saved version is immutable, so a later upstream change cannot silently replace it.
If a question mentions retaining public dependencies in an Azure DevOps feed, surviving an upstream outage after those versions were saved, or using one configured feed for internal and external packages, it is pointing at Azure Artifacts upstream sources. If the requirement instead emphasises GitHub-native package hosting and GitHub Actions/API integration, consider GitHub Packages and then check the selected registry's permission model.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/feeds
- https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/upstream-sources
- https://learn.microsoft.com/en-us/azure/devops/artifacts/feeds/feed-permissions
- https://docs.github.com/en/packages/learn-github-packages/introduction-to-github-packages
- https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages