Azure Deployment Environments
Design and implement Azure Deployment Environments
Current product state: Azure Deployment Environments (ADE) entered maintenance mode in May 2026. Existing capabilities remain available and supported, but no additional features are planned. The July 2026 AZ-400 blueprint still tests this objective.
Architecture and authority
| Component | Purpose |
|---|---|
| Dev center | Groups projects and shared governance |
| Catalog | Curated IaC definitions from GitHub or Azure DevOps; dev-center scope serves associated projects, project scope serves one project |
| Environment definition | IaC template plus an environment.yaml manifest |
| Dev-center environment type | Names an allowed class such as sandbox, test, or production |
| Project environment type | Selects subscription, deployment identity, policies, tags, creator roles, and optional user/group access |
| Project | Team/business boundary through which definitions and environment types are exposed |
Platform engineers commonly curate dev-center catalogs. Authorized project admins can manage project catalogs for their teams, while repository permissions determine who may author their source. Give developers the Deployment Environments User role to create/manage environments; keep that ADE service role distinct from the configured Azure roles on deployed resources.
Implementation flow
- Create a dev center and attach a catalog containing each template and
environment.yaml. - Define dev-center environment types, create a project, and configure its project environment types.
- Configure the deployment identity, target subscription, policies, tags, and resource roles.
- Grant the Deployment Environments User role, then create by portal, CLI/API, or CI/CD.
- Redeploy when required; schedule expiry or delete the environment to remove its associated resources/resource group.
az devcenter dev environment create --dev-center-name <devCenter> \
--project-name <project> --environment-name <environment> \
--environment-type <type> --environment-definition-name <definition> \
--catalog-name <catalog>Creation automatically makes the required resources and a resource group. ADE supports CI/CD—including short-lived branch/PR environments—and central cost/security visibility. Deployed-resource access comes from project-environment-type configuration; do not assume every member universally receives Contributor.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/azure/deployment-environments/maintenance-mode
- https://learn.microsoft.com/en-us/azure/deployment-environments/overview-what-is-azure-deployment-environments
- https://learn.microsoft.com/en-us/azure/deployment-environments/concept-environments-key-concepts
- https://learn.microsoft.com/en-us/azure/deployment-environments/how-to-configure-project-environment-types
- https://learn.microsoft.com/en-us/azure/deployment-environments/concept-deployment-environments-role-based-access-control
- https://learn.microsoft.com/en-us/azure/deployment-environments/how-to-create-access-environments
- https://learn.microsoft.com/en-us/azure/deployment-environments/how-to-schedule-environment-deletion
- https://learn.microsoft.com/en-us/azure/deployment-environments/tutorial-deploy-environments-in-cicd-github
- https://learn.microsoft.com/en-us/azure/deployment-environments/how-to-configure-catalog
- https://learn.microsoft.com/en-us/rest/api/devcenter/developer/environments/delete-environment?view=rest-devcenter-developer-2025-02-01