Azure-devops-docs: Variable Group History

[alohaninja]

Are there plans to support variable group history - or is the guidance to use Key Vault and track any historical updates there? Scenario - someone updates a key and you have no idea when or why.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 4827aa99-ae62-bd63-6f2f-a87a4065ed27
• Version Independent ID: c9e461ee-7f42-3503-9460-18fa3a807bbb
• Content: Variable groups for Azure Pipelines and TFS - Azure Pipelines
• Content Source: docs/pipelines/library/variable-groups.md
• Product: devops
• Technology: devops-cicd
• GitHub Login: @RoopeshNair
• Microsoft Alias: ronai

[RoopeshNair]

@ashokirla - for comments

[michaelharrod]

We have the same question, how do we control the risk of variable groups changing without anyone being notified?

[andrewatfornax]

+1

Auditing of the variable groups, and the associated variable group scope, is highly needed, as deployments can go badly wrong when variables are incorrectly changed, or the scope is incorrectly changed.

Knowing what has been changed (and by who, and when) is critical to safe deployments.

[StephenRSkinner]

Also need the ability to revert from history, like you can on build and release definitions. I just got bit by this, after a week of configuring new environments. One person reverted everything to previous values and there's no way to get them back, due to the lack of this functionality.

[8enSmith]

It would be great if one could create a variable group YAML file which could be stored in a repository alongside the pipeline YAML files. They could then be versioned just like the pipeline YAML files, making it easy to track changes in the values of these variables.

[RoopeshNair]

@8enSmith -

It would be great if one could create a variable group YAML file which could be stored in a repository alongside the pipeline YAML files

it is not recommended to store the secrets in a repository. Unless I got your statements wrong

[andrewatfornax]

@8enSmith - not all variables stored in a variable group are necessarily secrets! However, I think your point is valid; because some variables might be secrets, then storing them in an otherwise open core repository is not a good solution.

Instead, Azure DevOps needs built-in versioning of variables & variable groups as a solution.

[RoopeshNair]

@8enSmith - sure, we do have it on our backlog, however not on top of our list at the moment. We are working on issues that impact broader set of customers. As a workaround, you can use Variable Groups backed by Azure Key Vault. Key Vault supports versioned history of changes. I would recommend you to suggest the changes on DevCommunity. This would allow us to priortize the asks