Microsoft Agentic DevOps Engineer

Every change should be traceable from idea to production. You link boards, pull requests and releases, wire Azure Boards and GitHub together, and use AI tools to keep documentation current without letting it drift from the code.

• Linking work items, commits, pull requests and releases
• Connecting Azure Boards and GitHub
• Notifications, webhooks and Teams integration
• Generating and reviewing documentation with AI tools
• Wikis and README conventions for people and agents
• Auditing a change from work item to deployment

You build A traceable path from a work item to a production release, with generated documentation.

Agents working in your repositories need boundaries. You write agent rules and skills, choose which MCP servers an agent may use, and decide what an agent may read, change and run on its own.

• Instruction files and agent rules for a repository
• Skills that package repeatable team practice
• MCP servers for Azure Boards and GitHub
• Permissions: what an agent may read, edit and run
• Reviewing agent-authored changes
• Limiting the blast radius of a mistaken agent

You build A repository agent policy with rules, one skill and an approved list of MCP servers.

Branching and repository policy shape how safely a team moves. You choose a branching model, enforce policies and protection rules on both platforms, and manage large repositories and migrations between them.

• Trunk-based and release-branch strategies compared
• Branch policies in Azure Repos
• Branch protection rules and rulesets in GitHub
• Pull request design and required reviews
• Large repositories and Git LFS
• Migrating a repository between platforms

You build A branching and policy setup applied identically on both platforms to one repository.

Multi-stage YAML pipelines are the backbone of delivery. You write them with Copilot’s help, then read every line critically, using templates, parameters and variables that keep pipelines reusable.

• Anatomy of a multi-stage YAML pipeline
• Templates, parameters and variable groups
• Prompting Copilot for pipeline YAML
• Reviewing generated pipelines for mistakes
• Triggers, conditions and environments
• Pipeline speed and caching

You build A reusable multi-stage pipeline template, drafted with Copilot and corrected by hand.

GitHub Actions automates build and release, and Agentic Workflows bring an agent into a repository’s automation. You build workflows, then decide which tasks an agent may take on and how its work is reviewed.

• Workflow syntax, events, jobs and reusable workflows
• Matrix builds and caching
• Environments and approvals in Actions
• What Agentic Workflows are and where they fit
• Constraining an agentic workflow’s permissions
• Reviewing and auditing what an agentic workflow did

You build A GitHub workflow that builds and tests a project, with one tightly constrained agentic task.

Pipelines depend on where they run and what they produce. You set up hosted and self-hosted runners and agents, manage package feeds and versions, and add test and quality gates that stop bad releases.

• Hosted and self-hosted runners and agents
• Package feeds, versioning and retention
• Pipeline artifacts compared with packages
• Unit, integration and load tests in a pipeline
• Quality gates and release approvals
• Flaky tests and how to handle them

You build A pipeline with a package feed, test stages and a gate that blocks a failing release.

How you release matters as much as what you release. You compare blue-green, canary and ring deployments, and manage the infrastructure itself as code with Bicep, so environments can be rebuilt and reviewed like software.

• Blue-green, canary and ring deployments
• Feature flags and progressive exposure
• Rollback and roll-forward decisions
• Bicep modules and parameters
• Deploying infrastructure from a pipeline
• Detecting and fixing configuration drift

You build A Bicep-defined environment released with a canary strategy and a tested rollback.

A leaked key in a pipeline is a breach. You replace long-lived credentials with workload identity and federated sign-in, keep the remaining secrets in Key Vault, and set permissions for people, pipelines and agents.

• Why long-lived keys fail
• Federated credentials from Actions and Azure Pipelines
• Managed identities for deployment targets
• Key Vault for the secrets that remain
• Keeping sensitive data out of agent prompts and logs
• Least-privilege roles for pipelines

You build A pipeline that deploys to Azure with no stored secrets, checked by an audit of its configuration.

Security checks belong in the pipeline. You turn on code, dependency and secret scanning, triage the results, and set policies that block risky changes while keeping developers moving.

• Code scanning and its triage workflow
• Dependency scanning and Dependabot updates
• Secret scanning and push protection
• Advanced Security on GitHub and Azure DevOps
• Compliance checks as pipeline policy
• Responding to a leaked secret

You build Scanning enabled across a repository, with a policy that blocks a deliberately risky change.

You cannot run what you cannot see. You configure monitoring for applications and for the DevOps tooling, write KQL to ask real questions of the logs, and design alerts that someone will act on.

• Azure Monitor, Log Analytics and Application Insights
• Collecting logs and metrics from workloads
• KQL fundamentals for investigation
• Alert rules, action groups and noise control
• Monitoring the pipelines themselves
• Dashboards and workbooks for a team

You build A set of KQL queries, alerts and a workbook for one application and its pipeline.

AI agents can watch workloads and help investigate incidents. You deploy the Azure SRE Agent and the Observability Agent, define what each may see and do, and check their findings against Monitor data and Copilot agent logs.

• What the SRE and Observability agents do
• Deploying and scoping each agent
• Granting access without granting too much
• Investigating an incident with agent help
• Verifying agent conclusions in KQL
• Reading Copilot agent logs

You build A deployed SRE agent with a scoped role, and a written review of one agent-assisted investigation.

Combine the strands in one delivery system. You plan the work, protect the source, build and release with gates, secure the chain, and add agents for operation, then justify each choice against measured outcomes.

• Planning the work and its measures
• Source, pipeline and release design
• Securing the delivery chain
• Adding monitoring and agents
• Reviewing the system against its measures

You build A complete delivery setup from board to monitored production, with an agent policy.