{"id":66312,"date":"2023-01-24T23:13:47","date_gmt":"2023-01-25T07:13:47","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/devops\/?p=66312"},"modified":"2023-01-24T23:27:40","modified_gmt":"2023-01-25T07:27:40","slug":"disable-creation-of-classic-pipelines","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/devops\/disable-creation-of-classic-pipelines\/","title":{"rendered":"Disable creation of classic pipelines"},"content":{"rendered":"<p>YAML pipelines offer the best security for your Azure Pipelines. In contrast to classic build and release pipelines, YAML pipelines:<\/p>\n<ul>\n<li><strong>Can be code reviewed<\/strong>. YAML pipelines are no different from any other piece of code. You can prevent malicious actors from introducing malicious steps in your pipelines by enforcing the use of Pull Requests to merge changes. <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/repos\/git\/branch-policies-overview\">Branch policies<\/a> make it easy for you to set this up.<\/li>\n<li><strong>Provide resource access management<\/strong>. Resource owners decide if a YAML pipeline can access a resource or not. This prevents attacks like <a href=\"https:\/\/devblogs.microsoft.com\/devops\/pipeline-stealing-another-repo\/\">stealing another repository<\/a>. <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/pipelines\/process\/approvals\">Approvals and checks<\/a> provide access control that works for <em>each<\/em> pipeline run.<\/li>\n<li><strong>Support runtime parameters<\/strong>. <a href=\"https:\/\/docs.microsoft.com\/azure\/devops\/pipelines\/process\/runtime-parameters\">Runtime parameters<\/a> help you avoid a host of security issues related to variables, such as <a href=\"https:\/\/devblogs.microsoft.com\/devops\/pipeline-argument-injection\/\">Argument Injection<\/a>.<\/li>\n<\/ul>\n<p>This is why many of you who are security-conscious choose to <em>only<\/em> use YAML pipelines. Alas, as long as your engineers can choose to use classic pipelines, you will have to continue worrying about their security.<\/p>\n<p>We&#8217;ve launched a new feature that allows you to <em>disable creation of classic pipelines<\/em>. When you enable it, no classic build pipeline, classic release pipeline, task groups, and deployment groups can be created. Thus, there won&#8217;t be any (new) classic pipelines to worry about.<\/p>\n<h2>Enable the feature<\/h2>\n<p>You can disable creation of classic pipelines by turning on a toggle at either organization level or project level.<\/p>\n<p>To turn it on at organization level, navigate to your <em>Organization settings<\/em>, then under the <em>Pipelines<\/em> section choose <em>Settings<\/em>. In the <em>General<\/em> section, toggle on <em>Disable creation of classic build and classic release pipelines<\/em>.<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/organization-settings.png\"><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/organization-settings-1024x566.png\" alt=\"Screenshot of organization-level pipelines settings\" width=\"640\" height=\"354\" class=\"alignnone size-large wp-image-66306\" srcset=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/organization-settings-1024x566.png 1024w, https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/organization-settings-300x166.png 300w, https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/organization-settings-768x424.png 768w, https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/organization-settings.png 1176w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>When you turn it on at organization level, it is on for all projects in that organization. If you leave it off, you can choose for which projects you wish to turn it on.<\/p>\n<p>To turn on the toggle on at organization level, you need <em>Project Collection Administrator<\/em> rights, while for a project, you need <em>Project Administrator<\/em> rights.<\/p>\n<h2>How the feature works<\/h2>\n<p>If you turned on the toggle to <em>Disable creation of classic build and classic release pipelines<\/em>, then no classic build pipeline, classic release pipeline, task groups, and deployment groups can be created.<\/p>\n<p>The user interface will not show the <em>Releases<\/em>, <em>Task groups<\/em>, and <em>Deployment groups<\/em> left-side menu items if you have none of them.<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/sidemenu.png\"><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/sidemenu.png\" alt=\"Screenshot of Pipelines side menu\" width=\"400\" height=\"597\" class=\"alignnone size-full wp-image-66307\" srcset=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/sidemenu.png 400w, https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/sidemenu-201x300.png 201w\" sizes=\"(max-width: 400px) 100vw, 400px\" \/><\/a><\/p>\n<p>When creating a new build pipeline, you&#8217;ll no longer be able to choose <em>Other Git<\/em> or <em>Subversion<\/em> as pipeline repository.<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-pipeline.png\"><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-pipeline.png\" alt=\"Screenshot of creating a new pipeline\" width=\"800\" height=\"469\" class=\"alignnone size-full wp-image-66308\" srcset=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-pipeline.png 800w, https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-pipeline-300x176.png 300w, https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-pipeline-768x450.png 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/a><\/p>\n<p>REST APIs related to creating classic build pipeline, classic release pipeline, task groups, and deployment groups will not work anymore.<\/p>\n<h2>Existing classic pipelines<\/h2>\n<p>If you have classic build pipelines, classic release pipelines, task groups, or deployment groups, you&#8217;ll still be able to edit and run them. The Pipelines left-side menu will continue to show the corresponding menu items. However, the buttons to create new ones will be disabled.<\/p>\n<p>The following screenshot shows the experience when attempting to create a new release pipeline.<\/p>\n<p><a href=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-release-disabled.png\"><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-release-disabled.png\" alt=\"Screenshot of disabled new release menu\" width=\"600\" height=\"228\" class=\"alignnone size-full wp-image-66309\" srcset=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-release-disabled.png 600w, https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2023\/01\/new-release-disabled-300x114.png 300w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/a><\/p>\n<h2>Rollout<\/h2>\n<p>The feature is available to all customers and is turned <em>off<\/em> by default. This means there are no changes to your pipelines behavior. We do not plan to automatically turn on the feature for existing organizations.<\/p>\n<p>We plan to have the feature turned <em>on<\/em> by default for organizations created after <em>March 2023<\/em>. This means new organizations will be, by default, YAML-only.<\/p>\n<h2>FAQ<\/h2>\n<h3>Are classic pipelines going away?<\/h3>\n<p>No. Classic pipelines, both build and release, will continue to work in the future as well.<\/p>\n<h3>I can&#8217;t turn on <em>Disable creation of classic build and classic release pipelines<\/em>. Why?<\/h3>\n<p>To turn on the <em>Disable creation of classic build and classic release pipelines<\/em> toggle at organization level, you need to have <em>Project Collection Administrators<\/em> rights.<\/p>\n<p>To turn on the <em>Disable creation of classic build and classic release pipelines<\/em> toggle at project level, you need to have <em>Project Administrators<\/em> rights.<\/p>\n<h3>Where can I learn more about securing my YAML pipelines?<\/h3>\n<p>Read our <a href=\"https:\/\/learn.microsoft.com\/azure\/devops\/pipelines\/security\/overview\">Securing Azure Pipelines<\/a> walkthrough for recommendations to help you put together a secure YAML-based CI\/CD pipeline.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>YAML pipelines offer the best security for your Azure Pipelines. In contrast to classic build and release pipelines, YAML pipelines: Can be code reviewed. YAML pipelines are no different from any other piece of code. You can prevent malicious actors from introducing malicious steps in your pipelines by enforcing the use of Pull Requests to [&hellip;]<\/p>\n","protected":false},"author":76405,"featured_media":54304,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[226,1],"tags":[],"class_list":["post-66312","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ci","category-devops"],"acf":[],"blog_post_summary":"<p>YAML pipelines offer the best security for your Azure Pipelines. In contrast to classic build and release pipelines, YAML pipelines: Can be code reviewed. YAML pipelines are no different from any other piece of code. You can prevent malicious actors from introducing malicious steps in your pipelines by enforcing the use of Pull Requests to [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/66312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/users\/76405"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/comments?post=66312"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/66312\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media\/54304"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media?parent=66312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/categories?post=66312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/tags?post=66312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}