Agent and runner infrastructure
Design and implement agent and runner infrastructure
Every job needs a machine. Choosing which machine is a cost, security and maintainability decision, and the exam tests the trade-off rather than the click-path.
The options
| Option | Ownership and billing | Use when |
|---|---|---|
| Microsoft-hosted | Microsoft-managed; current paid capacity uses parallel-job concurrency. The free hosted job has job and monthly minute limits; legacy per-minute plans still exist | Standard images and a fresh Microsoft-provided VM for each job |
| Self-hosted | You own the machine and tools. Azure DevOps Services uses self-hosted parallel-job capacity; Azure DevOps Server does not charge for self-hosted concurrency | Direct private connectivity, machine-bound tooling, or machine-local state |
| VM Scale Set agents | Scale set in your Azure subscription; Azure-resource cost plus Services self-hosted parallel-job capacity | Team-managed autoscaling with a custom image |
| Managed DevOps Pools | Fully managed; Azure-resource cost plus Services self-hosted parallel-job capacity | Microsoft's current recommendation when considering an autoscalable self-hosted pool |
| GitHub-hosted for Azure Pipelines | Microsoft-managed on GitHub-hosted infrastructure; per-minute PAYG with no free tier | Larger machines when the preview is available in the organization's region |
Microsoft-hosted agents exist only in Azure DevOps Services — they are not available in Azure DevOps Server. Azure DevOps Server therefore uses self-hosted agents. A hosted Azure DevOps Services pipeline can still deploy to an on-premises target when its agent has the required connectivity.
Why teams move to self-hosted
Three reasons recur, and they map directly to exam scenarios:
- Software that must be preinstalled or machine-bound, for example because of its licence. Hosted jobs can install other tools during a run.
- Direct private connectivity to a non-public endpoint or on-premises system.
- Machine-local persistence. Caches and configuration can survive between runs on a self-hosted agent.
A Microsoft-hosted agent gets a fresh VM for every job, whose filesystem is
discarded afterward. That does not prohibit caching: Cache@2 can restore a
server-backed dependency cache across pipeline runs. Choose self-hosted when the
state must persist locally on the machine, not merely because a dependency
restore is slow.
Billing models differ in kind, not just amount
Under Azure DevOps Services' current paid parallel-jobs model, Microsoft-hosted capacity is bought as concurrency. The free hosted job is limited to 1,800 minutes per month and 60 minutes per job; paid capacity removes the monthly limit and allows up to 360 minutes per job. Earlier customers can still be on a legacy per-minute plan.
GitHub-hosted agents for Azure Pipelines are a separate per-minute PAYG preview with no free tier, and availability is still rolling out by region.
Maintainability
Self-hosted is not free after setup. You own OS and tool maintenance, workspace hygiene, private connectivity, and least-privilege machine security. Keep the agent and operating system compatible; required agent-software updates can be automatic on supported systems, while an unsupported OS still requires a machine upgrade. Microsoft recommends considering Managed DevOps Pools instead of designing a new autoscalable VM Scale Set agent pool.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/agents
- https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted
- https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/cache-v2
- https://learn.microsoft.com/en-us/azure/devops/pipelines/licensing/concurrent-jobs
- https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/github-hosted
- https://learn.microsoft.com/en-us/azure/devops/managed-devops-pools/migrate-from-scale-set-agents
- https://learn.microsoft.com/en-us/azure/devops/managed-devops-pools/pricing
- https://learn.microsoft.com/en-us/azure/devops/pipelines/security/misc
- https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/v5-agent