Three Components Needed to Stand Up a Self-Hosted Agent Pool
Which THREE components are required to set up a self-hosted agent pool in Azure Pipelines?
Quick Answer
Standing up a self-hosted agent pool needs the Azure Pipelines agent software installed on the target machine (the piece that actually registers with the pool and runs jobs), a personal access token to authenticate that registration, and network connectivity from the machine out to Azure DevOps — without any one of these three, the agent can't join the pool or pick up work.
⚠ Common exam trap
It's easy for candidates to confuse the Azure VM extension (a convenience tool) with a mandatory requirement, or they mistakenly think a deployment group target is needed for agent pools, when in fact deployment groups are for targeting specific machines in a release context, not for agent registration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The agent software installed on the target machine
To set up a self-hosted agent pool in Azure Pipelines, you must install the agent software on the target machine (option A), which provides the listener that polls Azure DevOps for jobs and runs them locally. You also need to configure the agent with the agent pool name and the URL of the Azure DevOps organization (option C), since the agent registers itself into a specific pool under a specific organization endpoint. Authentication requires a personal access token (option E) with the appropriate scope (typically Agent Pools read/manage), which the agent uses during configuration to register with the service. Option B is incorrect because deployment groups are a separate feature for classic release pipelines targeting machines, not the mechanism for creating an agent pool. Option D is incorrect because the Azure VM extension for Azure Pipelines Agent is an optional convenience for provisioning agents on Azure VMs, not a required component of a self-hosted agent pool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The agent software installed on the target machine
Why this is correct
Installing the agent software on the target machine is mandatory: the agent listener establishes the outbound connection to Azure Pipelines and executes queued jobs. Without it, the machine cannot register with the pool or run pipeline work, so the self-hosted capability simply does not exist.
- ✗
A deployment group target
Why it's wrong here
A deployment group target is an agent registered for classic release pipelines targeting machines, not a component of an agent pool. Self-hosted pools require an organisation-level pool, agent software and a personal access token for registration.
- ✓
The agent pool name and URL of the Azure DevOps organization
Why this is correct
Registering a self-hosted agent requires the pool name and the Azure DevOps organisation URL, since the agent's configuration script uses both to authenticate and join the correct pool. These satisfy the stem's requirement for identifying the target organisation and destination pool, alongside the personal access token.
- ✗
Azure VM extension for Azure Pipelines Agent
Why it's wrong here
The Azure VM extension installs and configures the agent on a VM, but it is not a required pool component; a pool needs a name, agent software and permissions. It is tempting because the extension automates agent installation on existing VMs, which is the correct choice when onboarding many Azure VMs at scale.
- ✓
A personal access token (PAT) for authentication
Why this is correct
A personal access token authenticates the agent to Azure Pipelines during configuration, satisfying the requirement that self-hosted agents register with a pool using scoped credentials. The PAT needs the Agent Pools (read, manage) scope, and without it the agent cannot be added to the pool.
Visual reference
Go deeper
Related to this question
Learn chapter
Implementing a Release Pipeline
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
Key term
Self-hosted agent
A self-hosted agent is a software component that you install and manage on your own infrastructure to run automated tasks for a CI/CD or DevOps platform.
About these practice questions
One of 696 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your build pipeline uses a self-hosted agent in your on-premises network. The agent pool is configured to use the 'latest' agent version. Recently, a new version of the Azure Pipelines agent was released, and your builds started failing because the new agent requires .NET 6.0, which is not installed on the agent machine. What is the best way to prevent this issue in the future?
medium- ✓ A.Configure the agent pool to use a specific agent version (e.g., '2.210.0') and test new versions in a separate pool before updating.
- B.Switch to using Microsoft-hosted agents instead of self-hosted.
- C.Disable automatic agent updates on the self-hosted agents.
- D.Install .NET 6.0 on the agent machine to meet the new requirement.
Why A: It decouples your production pipeline from automatic agent updates. By pinning the agent pool to a known-working version (e.g., '2.210.0'), you can validate new agent releases in a separate test pool before rolling them out. This prevents breaking changes—like a new .NET dependency—from impacting your builds without prior testing.
Variation 2. Which TWO conditions must be met for a self-hosted agent to be used in an Azure Pipelines agent pool? (Choose two.)
medium- A.The agent must be in the Default pool.
- ✓ B.The agent must have network access to Azure Pipelines.
- C.The agent must run on Windows Server.
- D.The agent must be installed on a virtual machine.
- ✓ E.The agent must be registered with the agent pool.
Why B: A self-hosted agent must have outbound network connectivity to Azure Pipelines (specifically to the Azure DevOps service endpoints) in order to receive job assignments, download tasks, and report status. Without this network access, the agent cannot communicate with the orchestration layer and will remain offline. This is a fundamental requirement for any agent, whether hosted or self-hosted.
Variation 3. You are designing a multi-stage YAML pipeline in Azure DevOps that builds, tests, and deploys a .NET Core application. The pipeline must use a self-hosted agent pool for compliance. You need to minimize agent idle time while ensuring that the agent is always available for builds. What should you do?
hard- A.Provision a virtual machine scale set with a fixed number of agents
- B.Install multiple agents on a single VM to maximize utilization
- ✓ C.Deploy a scale set agent pool with autoscaling enabled
- D.Use a single persistent agent and queue builds when idle
Why C: A scale set agent pool with autoscaling enabled dynamically provisions and deprovisions Azure virtual machines based on the pipeline's demand, minimizing idle time while ensuring agents are available when builds are triggered. This approach aligns with the requirement for a self-hosted agent pool for compliance and optimizes cost by scaling down when no jobs are pending.
Variation 4. Which THREE components are required to implement a self-hosted agent pool in Azure Pipelines?
hard- A.An Azure Resource Manager service connection.
- B.A YAML pipeline definition.
- ✓ C.The Azure Pipelines agent software installed on the machine.
- ✓ D.A virtual machine or physical server to host the agent.
- ✓ E.A personal access token (PAT) with agent pool management permissions.
Why C: The Azure Pipelines agent software is the core component that executes pipeline jobs on the self-hosted machine. Without installing the agent software (via the agent configuration script), the machine cannot register with Azure Pipelines or run any tasks, making it a mandatory requirement for a self-hosted agent pool.
Variation 5. Your YAML pipeline uses a self-hosted agent pool. You need to ensure that only the pipeline can trigger builds on that pool, preventing other projects from using it. What should you do?
hard- A.Set the agent pool to 'Disabled' for other projects
- ✓ B.Configure pipeline permissions in the agent pool security settings
- C.Use a deployment group instead of an agent pool
- D.Create a separate agent pool for each project
Why B: Azure DevOps agent pool security settings allow you to restrict which pipelines or projects can use a specific agent pool. By configuring pipeline permissions, you can grant the 'Use' permission only to the intended pipeline, preventing other projects from triggering builds on that pool. This ensures exclusive access without disabling the pool for all other uses.
Variation 6. Your company uses Azure DevOps and must enforce that all pipelines use approved agent pools. The security team wants to prevent the use of the default agent pool. What should you do?
medium- A.Use pipeline settings to require authorization for the default pool
- ✓ B.Set agent pool permissions to deny the default pool for all projects
- C.Remove the default agent pool from the organization
- D.Disable the default agent pool in project settings
Why B: Setting agent pool permissions to deny the default pool for all projects explicitly blocks its use across the organization. This enforces the security policy by preventing any pipeline from selecting the default agent pool, while still allowing administrators to manage the pool if needed. In Azure DevOps, agent pool permissions control which users, teams, or projects can use a pool, and setting 'Deny' overrides any inherited 'Allow' permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.