How Azuredevops git checkout or cloning is happening - azure-devops

Question

I would like to understand how the auto git checkout is happening azuredevops build pipelines. How the authentication to ADO repo is happening from the ADO build agent. Which user is used by the ADO pipeline to clone or checkout this repo.
My concern is ,when i trigger a pipeline, i could see that the repository is checkedout to build agent. Which user is used by the ADO ? when i try to push, its asking for AD authentication, So how the checkout and push are differ in ADO pipeline perspective?

Answer 1

when you set up your pipeline initially, you specified where you code resides, e.g. on GitHub. As part of that step a service connection will have been created (you have been asked for it). So whatever you specified there, will be used. You can check it out in the project settings under "Service Connections"

Answer 2

It depends on which source code tool you use. For example If you use Github, you will have to setup a connection with it. This can be accomplished on project settings under Github connections. You can then use this service connection and checkout your code.
This Github integration has been made from a particular User and by navigating on github -> Settings -> Integrations -> Applications, you will notice the exact permissions.
I imagine that Github/Azure Devops then will use this integration object that is created for the authentication.
On Azure Repos repositories, you do not need a service connection in place. The repository can be checked out automatically.
When you run the pipeline you can see the exact commands that have been executed for the authentication.
git remote add origin https://ORG.visualstudio.com/test-project/_git/test-project
git config gc.auto 0
git config --get-all http.https://ORG.visualstudio.com/test-project/_git/test-project.extraheader
git config --get-all http.extraheader
git config --get-regexp .*extraheader
git config --get-all http.proxy
git config http.version HTTP/1.1
git -c http.extraheader="AUTHORIZATION: bearer ***" fetch --force --tags --prune --prune-tags --progress --no-recurse-submodules origin

Answer 3

Microsoft-hosted agents run on secure Azure platform. However, you must be aware of the following security considerations.
Although Microsoft-hosted agents run on Azure public network, they are not assigned public IP addresses. So, external entities cannot target Microsoft-hosted agents.
Microsoft-hosted agents are run in individual VMs, which are re-imaged after each run. Each agent is dedicated to a single organization, and each VM hosts only a single agent.
There are several benefits to running your pipeline on Microsoft-hosted agents, from a security perspective. If you run untrusted code in your pipeline, such as contributions from forks, it is safer to run the pipeline on Microsoft-hosted agents than on self-hosted agents that reside in your corporate network.
When a pipeline needs to access your corporate resources behind a firewall, you have to allow the IP address range for the Azure geography. This may increase your exposure as the range of IP addresses is rather large and since machines in this range can belong to other customers as well. The best way to prevent this is to avoid the need to access internal resources.
Hosted images do not conform to CIS hardening benchmarks. To use CIS-hardened images, you must create either self-hosted agents or scale-set agents.
Taken from Microsoft-hosted agents - Security.
The most important part is probably
Microsoft-hosted agents are run in individual VMs, which are re-imaged after each run. Each agent is dedicated to a single organization, and each VM hosts only a single agent.
Next to that, check Create and manage agent pools - Security of agent pools.