Three Components Needed to Stand Up a Self-Hosted Agent Pool
Which THREE components are required to set up a self-hosted agent pool in Azure Pipelines?
Quick Answer
Standing up a self-hosted agent pool needs the Azure Pipelines agent software installed on the target machine (the piece that actually registers with the pool and runs jobs), a personal access token to authenticate that registration, and network connectivity from the machine out to Azure DevOps — without any one of these three, the agent can't join the pool or pick up work.
⚠ Common exam trap
It's easy for candidates to confuse the Azure VM extension (a convenience tool) with a mandatory requirement, or they mistakenly think a deployment group target is needed for agent pools, when in fact deployment groups are for targeting specific machines in a release context, not for agent registration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The agent software installed on the target machine
The self-hosted agent requires the Azure Pipelines agent software to be installed on the target machine. This software, which includes the agent listener and worker processes, is what registers the machine with the agent pool and executes pipeline jobs. Without the agent software, the machine cannot communicate with Azure Pipelines or run any tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The agent software installed on the target machine
Why this is correct
The agent software is essential for the self-hosted agent.
- ✗
A deployment group target
Why it's wrong here
Deployment groups are separate from agent pools.
- ✓
The agent pool name and URL of the Azure DevOps organization
Why this is correct
The agent needs to know the organization URL and pool name to register.
- ✗
Azure VM extension for Azure Pipelines Agent
Why it's wrong here
The VM extension is one way to install the agent but not strictly required; you can install manually.
- ✓
A personal access token (PAT) for authentication
Why this is correct
A PAT is required to register the agent with Azure DevOps.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your build pipeline uses a self-hosted agent in your on-premises network. The agent pool is configured to use the 'latest' agent version. Recently, a new version of the Azure Pipelines agent was released, and your builds started failing because the new agent requires .NET 6.0, which is not installed on the agent machine. What is the best way to prevent this issue in the future?
medium- ✓ A.Configure the agent pool to use a specific agent version (e.g., '2.210.0') and test new versions in a separate pool before updating.
- B.Switch to using Microsoft-hosted agents instead of self-hosted.
- C.Disable automatic agent updates on the self-hosted agents.
- D.Install .NET 6.0 on the agent machine to meet the new requirement.
Why A: It decouples your production pipeline from automatic agent updates. By pinning the agent pool to a known-working version (e.g., '2.210.0'), you can validate new agent releases in a separate test pool before rolling them out. This prevents breaking changes—like a new .NET dependency—from impacting your builds without prior testing.
Variation 2. Which TWO conditions must be met for a self-hosted agent to be used in an Azure Pipelines agent pool? (Choose two.)
medium- A.The agent must be in the Default pool.
- ✓ B.The agent must have network access to Azure Pipelines.
- C.The agent must run on Windows Server.
- D.The agent must be installed on a virtual machine.
- ✓ E.The agent must be registered with the agent pool.
Why B: A self-hosted agent must have outbound network connectivity to Azure Pipelines (specifically to the Azure DevOps service endpoints) in order to receive job assignments, download tasks, and report status. Without this network access, the agent cannot communicate with the orchestration layer and will remain offline. This is a fundamental requirement for any agent, whether hosted or self-hosted.
Variation 3. You are designing a multi-stage YAML pipeline in Azure DevOps that builds, tests, and deploys a .NET Core application. The pipeline must use a self-hosted agent pool for compliance. You need to minimize agent idle time while ensuring that the agent is always available for builds. What should you do?
hard- A.Provision a virtual machine scale set with a fixed number of agents
- B.Install multiple agents on a single VM to maximize utilization
- ✓ C.Deploy a scale set agent pool with autoscaling enabled
- D.Use a single persistent agent and queue builds when idle
Why C: A scale set agent pool with autoscaling enabled dynamically provisions and deprovisions Azure virtual machines based on the pipeline's demand, minimizing idle time while ensuring agents are available when builds are triggered. This approach aligns with the requirement for a self-hosted agent pool for compliance and optimizes cost by scaling down when no jobs are pending.
Variation 4. Which THREE components are required to implement a self-hosted agent pool in Azure Pipelines?
hard- A.An Azure Resource Manager service connection.
- B.A YAML pipeline definition.
- ✓ C.The Azure Pipelines agent software installed on the machine.
- ✓ D.A virtual machine or physical server to host the agent.
- ✓ E.A personal access token (PAT) with agent pool management permissions.
Why C: The Azure Pipelines agent software is the core component that executes pipeline jobs on the self-hosted machine. Without installing the agent software (via the agent configuration script), the machine cannot register with Azure Pipelines or run any tasks, making it a mandatory requirement for a self-hosted agent pool.
Variation 5. Your YAML pipeline uses a self-hosted agent pool. You need to ensure that only the pipeline can trigger builds on that pool, preventing other projects from using it. What should you do?
hard- A.Set the agent pool to 'Disabled' for other projects
- ✓ B.Configure pipeline permissions in the agent pool security settings
- C.Use a deployment group instead of an agent pool
- D.Create a separate agent pool for each project
Why B: Azure DevOps agent pool security settings allow you to restrict which pipelines or projects can use a specific agent pool. By configuring pipeline permissions, you can grant the 'Use' permission only to the intended pipeline, preventing other projects from triggering builds on that pool. This ensures exclusive access without disabling the pool for all other uses.
Variation 6. Your company uses Azure DevOps and must enforce that all pipelines use approved agent pools. The security team wants to prevent the use of the default agent pool. What should you do?
medium- A.Use pipeline settings to require authorization for the default pool
- ✓ B.Set agent pool permissions to deny the default pool for all projects
- C.Remove the default agent pool from the organization
- D.Disable the default agent pool in project settings
Why B: Setting agent pool permissions to deny the default pool for all projects explicitly blocks its use across the organization. This enforces the security policy by preventing any pipeline from selecting the default agent pool, while still allowing administrators to manage the pool if needed. In Azure DevOps, agent pool permissions control which users, teams, or projects can use a pool, and setting 'Deny' overrides any inherited 'Allow' permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.