Retention strategy
Design and implement a retention strategy
Retention balances cost, compliance, traceability, analysis, support, and the ability to roll back. Start by separating the surfaces and the controls that own them.
What retention governs
| Surface | Control and decision |
|---|---|
| Pipeline runs, logs and attachments | Project Pipeline settings; retain for required run-hosted provenance and diagnostics |
| Environment deployment history | Environment history records pipeline/run deployments separately |
| Test results | Project Test settings; retain for the required analysis or compliance horizon |
| Run-scoped pipeline artifacts | Deleted with the run; protect the run or copy the artifact for rollback |
| Azure Artifacts package versions | Feed details; retain for supported builds and dependency availability |
Runs and rollback
Azure Pipelines no longer supports per-pipeline retention policies. Project settings govern runs and associated logs, artifacts, test results, metadata, symbols, and attachments. Azure Repos also protects configured recent runs for the default branch, protected branches, and the pipeline overall; other repository types use the pipeline-wide recent-run setting.
Deleting a producing run deletes its associated pipeline artifacts. If rollback downloads one of those artifacts, create a retention lease or retain the run indefinitely through the required rollback horizon. If the output must outlive run retention, copy the exact tested artifact to durable release storage. Rebuilding during an incident is not proof that the output matches what was tested.
An Azure DevOps environment separately records deployment history. Do not treat that history and the producing run's metadata as one indivisible record.
Feed packages
Feed retention is configured independently. A version is automatically deleted only when it exceeds the configured maximum versions and has not been downloaded within the configured recent-download window. Versions promoted to a view are exempt. Deleted packages remain recoverable from the recycle bin for 30 days.
A saved upstream copy remains available if its upstream later disappears, but only while the saved copy is retained. Choose each horizon from rollback, support, compliance, analysis, and cost requirements; there is no universal ordering between feed and run-artifact windows.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/azure/devops/pipelines/policies/retention
- https://learn.microsoft.com/en-us/azure/devops/pipelines/artifacts/pipeline-artifacts
- https://learn.microsoft.com/en-us/azure/devops/pipelines/process/environments
- https://learn.microsoft.com/en-us/azure/devops/artifacts/how-to/delete-and-recover-packages
- https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/package-graph
- https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/workload-supply-chain
- https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/publishing-workflows