Create reusable pipeline elements

The objective lists templates, task groups, variables and variable groups. One of those four is a trap.

Task groups are classic-only

Task groups are not supported in YAML pipelines. Use templates instead.

If a scenario says "YAML" and an option says "task group", that option is wrong. Task groups remain valid in classic build and release pipelines, which is why they still appear in the objective at all.

Templates: compose or constrain

yaml

# Compose — insert content into my pipeline
steps:
- template: templates/build-steps.yml
  parameters: { vmImage: ubuntu-latest }

yaml

# Constrain — the template governs what I may do
extends:
  template: templates/secure.yml
  parameters:
    buildSteps: [ { script: npm ci } ]

Typed parameters constrain the inputs a consumer may supply, while extends lets the base template fix the outer pipeline structure. Those are compile-time constraints after a pipeline adopts the template. To force adoption for a protected resource or environment, its owner configures a Required template check; a pipeline that does not extend the named template fails the check.

Variables and variable groups

Scope	Where
Pipeline / stage / job variable	`variables:` in the YAML
Shared across pipelines	Variable group in the Library
Backed by a vault	Variable group linked to Azure Key Vault

The security detail worth knowing:

Secret variables in a variable group are protected resources — you can attach approvals, checks and pipeline permissions to them. Access to non-secret variables is not limited by approvals, checks or pipeline permissions.

So "we put the connection string in a variable group and added an approval" only constrains anything if that variable is marked secret.

Primary sources

Reusable pipeline elements

Create reusable pipeline elements

Task groups are classic-only

Templates: compose or constrain

Variables and variable groups