CDN Domain URL change for Agents in Pipelines

Introduction

We have announced the retirement of Edgio CDN for Azure DevOps and are transitioning to a solution served by Akamai and Azure Front Door CDNs. This change affects Azure DevOps Pipelines customers. This article provides guidance for the Azure DevOps Pipelines customers to check if they are impacted by this change in CDN and the changes required if impacted. Impacted Azure DevOps Service and Azure DevOps Server Customers should complete the suggested changes by May 1, 2025 and May 15, 2025 respectively.

Why the change

Azure DevOps Pipelines customers can configure various forms of self-hosted Agent pools. In case of these self-hosted Agent pools, Agent package is downloaded from CDN. As Edgio CDN is being retired, the Domain URL owned by Edgio would be retired as well. So, customers need to open another Domain URL supported by the new CDNs. Some Azure DevOps Server customers also require a patch to incorporate the backend changes to manage the CDN retiral.

Azure DevOps Service and Azure DevOps Server Customer can refer to the respective subsections below to learn about the required changes.

Azure DevOps Service

Who is impacted

Azure DevOps Service customers using any of the following hosted agent pool types for their pipelines could be impacted, as agent packages for these pools are downloaded from the CDN.

1. Self-hosted agents

2. Azure Virtual Machine Scale Set agents

3. Managed DevOps Pools agents

Azure DevOps Service customers using any of the affected Agent pool should follow the following steps.

Steps

1. Update your organization’s firewall Allow list. Refer the section Update the firewall Allow list.

2. Configure and Run the Test Pipeline. Refer the section Test Pipeline. The Test pipeline should pass.

Timelines

Azure DevOps Service customers must complete the above changes by May 1st, 2025, to avoid disruptions in downloading the Agent package and impacting pipeline runs.

Azure DevOps Server

Azure DevOps Server customers using pipelines should follow the following steps depending on the server version. Please refer the table below.

Steps

1. Update your organization’s firewall Allow list. Refer the section Update the firewall Allow list.

2. Configure and Run the Test Pipeline. Refer the section Test Pipeline. If the test pipeline passes, proceed ahead.

3. Apply the Azure DevOps Server patch, depending on the version. Refer the patch version required in the table below.

Change details for various Azure DevOps Server version

Azure DevOps Server patches would be available on April 8, 2025.

Timelines

Azure DevOps Server customers must complete the suggested changes by May 15, 2025, to avoid disruptions in downloading the Agent package and impacting pipeline runs.

Test Pipeline

For the affected hosted Agents, we need to ensure that it can connect to the new CDN. We have provided a test job, that verifies if the new CDN is accessible from the network hosting the Agent. So, if your organization uses any of the affected agents, add the job given below to a test pipeline and run it.

- job: 
  pool:
    name: MyPool  # please change the name 'MyPool' with name of a Agent Pool used in your organization
  steps:
  - pwsh: |
      $ErrorActionPreference="Stop"
      try {
        Invoke-WebRequest -Method HEAD `
                          -Uri /agent/4.252.0/vsts-agent-win-x64-4.252.0.zip `
                          -TimeoutSec 5 `
                          -UseBasicParsing `
                          | Set-Variable response
        if ($response.StatusCode -lt 400) {
          Write-Host "Agent CDN is accessible. Status code: $($response.StatusCode)"
        } else {
          throw
        }
      } catch {
        Write-Host "##vso[task.logissue type=warning]Can't access download.agent.dev.azure.com. Please make sure the access is not blocked by a firewall."
        Write-Error "Agent CDN is inaccessible. Please make sure the access is not blocked by a firewall"
        $response | Format-List
      }
    displayName: 'Test download.agent.dev.azure.com access'

If you use a classic pipeline, please add the job to the PowerShell task in classic pipeline. Refer the snapshot below to add the job to the classic pipeline.

If the test pipeline fails, it means that new CDN is not accessible from your organization.

Update the firewall Allow list

The network or Firewall configuration of your organization may block access to the new CDNs. Please ensure that the new Domain URL is open. We recommend adding the new Domain URL to your organization’s firewall allow list.

If your organization’s policies do not permit adding the Domain URL with a wildcard, please add the following URL to your organization’s firewall Allow list:

Please note that you need to have at least one of the above suggested Domain URLs in the firewall Allow list to access the new CDN. You can run the suggested test pipeline after adding the URL to the Allow list to ensure that your organization’s network allows the access to the CDN.
You should not delete the existing domain URL from the Allow list. We will notify when it is safe to remove the same. This dual allow listing is to avoid any disruption in service during transition.

Conclusion

We understand these changes can be inconvenient, but they are necessary to ensure the continued reliability and performance of our services. We appreciate your cooperation and understanding in making this transition smooth and seamless. If you have any questions or need assistance, please do not hesitate to reach out to our support team.

FAQ