Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure DevOps Provider
  3. API Docs
  4. CheckBranchControl
Azure DevOps v3.8.0 published on Monday, Mar 17, 2025 by Pulumi
pulumi/pulumi-azuredevops

azuredevops.CheckBranchControl

Explore with Pulumi AI

azuredevops logo
Azure DevOps v3.8.0 published on Monday, Mar 17, 2025 by Pulumi
pulumi/pulumi-azuredevops

    Manages a branch control check on a resource within Azure DevOps.

    Example Usage

    Protect a service connection

    import * as pulumi from "@pulumi/pulumi";
import * as azuredevops from "@pulumi/azuredevops";

const example = new azuredevops.Project("example", {name: "Example Project"});
const exampleServiceEndpointGeneric = new azuredevops.ServiceEndpointGeneric("example", {
    projectId: example.id,
    serverUrl: "https://some-server.example.com",
    username: "username",
    password: "password",
    serviceEndpointName: "Example Generic",
    description: "Managed by Pulumi",
});
const exampleCheckBranchControl = new azuredevops.CheckBranchControl("example", {
    projectId: example.id,
    displayName: "Managed by Pulumi",
    targetResourceId: exampleServiceEndpointGeneric.id,
    targetResourceType: "endpoint",
    allowedBranches: "refs/heads/main, refs/heads/features/*",
    timeout: 1440,
});

    import pulumi
import pulumi_azuredevops as azuredevops

example = azuredevops.Project("example", name="Example Project")
example_service_endpoint_generic = azuredevops.ServiceEndpointGeneric("example",
    project_id=example.id,
    server_url="https://some-server.example.com",
    username="username",
    password="password",
    service_endpoint_name="Example Generic",
    description="Managed by Pulumi")
example_check_branch_control = azuredevops.CheckBranchControl("example",
    project_id=example.id,
    display_name="Managed by Pulumi",
    target_resource_id=example_service_endpoint_generic.id,
    target_resource_type="endpoint",
    allowed_branches="refs/heads/main, refs/heads/features/*",
    timeout=1440)

    package main

import (
	"github.com/pulumi/pulumi-azuredevops/sdk/v3/go/azuredevops"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := azuredevops.NewProject(ctx, "example", &azuredevops.ProjectArgs{
			Name: pulumi.String("Example Project"),
		})
		if err != nil {
			return err
		}
		exampleServiceEndpointGeneric, err := azuredevops.NewServiceEndpointGeneric(ctx, "example", &azuredevops.ServiceEndpointGenericArgs{
			ProjectId:           example.ID(),
			ServerUrl:           pulumi.String("https://some-server.example.com"),
			Username:            pulumi.String("username"),
			Password:            pulumi.String("password"),
			ServiceEndpointName: pulumi.String("Example Generic"),
			Description:         pulumi.String("Managed by Pulumi"),
		})
		if err != nil {
			return err
		}
		_, err = azuredevops.NewCheckBranchControl(ctx, "example", &azuredevops.CheckBranchControlArgs{
			ProjectId:          example.ID(),
			DisplayName:        pulumi.String("Managed by Pulumi"),
			TargetResourceId:   exampleServiceEndpointGeneric.ID(),
			TargetResourceType: pulumi.String("endpoint"),
			AllowedBranches:    pulumi.String("refs/heads/main, refs/heads/features/*"),
			Timeout:            pulumi.Int(1440),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureDevOps = Pulumi.AzureDevOps;

return await Deployment.RunAsync(() => 
{
    var example = new AzureDevOps.Project("example", new()
    {
        Name = "Example Project",
    });

    var exampleServiceEndpointGeneric = new AzureDevOps.ServiceEndpointGeneric("example", new()
    {
        ProjectId = example.Id,
        ServerUrl = "https://some-server.example.com",
        Username = "username",
        Password = "password",
        ServiceEndpointName = "Example Generic",
        Description = "Managed by Pulumi",
    });

    var exampleCheckBranchControl = new AzureDevOps.CheckBranchControl("example", new()
    {
        ProjectId = example.Id,
        DisplayName = "Managed by Pulumi",
        TargetResourceId = exampleServiceEndpointGeneric.Id,
        TargetResourceType = "endpoint",
        AllowedBranches = "refs/heads/main, refs/heads/features/*",
        Timeout = 1440,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuredevops.Project;
import com.pulumi.azuredevops.ProjectArgs;
import com.pulumi.azuredevops.ServiceEndpointGeneric;
import com.pulumi.azuredevops.ServiceEndpointGenericArgs;
import com.pulumi.azuredevops.CheckBranchControl;
import com.pulumi.azuredevops.CheckBranchControlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Project("example", ProjectArgs.builder()
            .name("Example Project")
            .build());

        var exampleServiceEndpointGeneric = new ServiceEndpointGeneric("exampleServiceEndpointGeneric", ServiceEndpointGenericArgs.builder()
            .projectId(example.id())
            .serverUrl("https://some-server.example.com")
            .username("username")
            .password("password")
            .serviceEndpointName("Example Generic")
            .description("Managed by Pulumi")
            .build());

        var exampleCheckBranchControl = new CheckBranchControl("exampleCheckBranchControl", CheckBranchControlArgs.builder()
            .projectId(example.id())
            .displayName("Managed by Pulumi")
            .targetResourceId(exampleServiceEndpointGeneric.id())
            .targetResourceType("endpoint")
            .allowedBranches("refs/heads/main, refs/heads/features/*")
            .timeout(1440)
            .build());

    }
}

    resources:
  example:
    type: azuredevops:Project
    properties:
      name: Example Project
  exampleServiceEndpointGeneric:
    type: azuredevops:ServiceEndpointGeneric
    name: example
    properties:
      projectId: ${example.id}
      serverUrl: https://some-server.example.com
      username: username
      password: password
      serviceEndpointName: Example Generic
      description: Managed by Pulumi
  exampleCheckBranchControl:
    type: azuredevops:CheckBranchControl
    name: example
    properties:
      projectId: ${example.id}
      displayName: Managed by Pulumi
      targetResourceId: ${exampleServiceEndpointGeneric.id}
      targetResourceType: endpoint
      allowedBranches: refs/heads/main, refs/heads/features/*
      timeout: 1440

    Protect an environment

    import * as pulumi from "@pulumi/pulumi";
import * as azuredevops from "@pulumi/azuredevops";

const example = new azuredevops.Project("example", {name: "Example Project"});
const exampleEnvironment = new azuredevops.Environment("example", {
    projectId: example.id,
    name: "Example Environment",
});
const exampleCheckBranchControl = new azuredevops.CheckBranchControl("example", {
    projectId: example.id,
    displayName: "Managed by Pulumi",
    targetResourceId: exampleEnvironment.id,
    targetResourceType: "environment",
    allowedBranches: "refs/heads/main, refs/heads/features/*",
});

    import pulumi
import pulumi_azuredevops as azuredevops

example = azuredevops.Project("example", name="Example Project")
example_environment = azuredevops.Environment("example",
    project_id=example.id,
    name="Example Environment")
example_check_branch_control = azuredevops.CheckBranchControl("example",
    project_id=example.id,
    display_name="Managed by Pulumi",
    target_resource_id=example_environment.id,
    target_resource_type="environment",
    allowed_branches="refs/heads/main, refs/heads/features/*")

    package main

import (
	"github.com/pulumi/pulumi-azuredevops/sdk/v3/go/azuredevops"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := azuredevops.NewProject(ctx, "example", &azuredevops.ProjectArgs{
			Name: pulumi.String("Example Project"),
		})
		if err != nil {
			return err
		}
		exampleEnvironment, err := azuredevops.NewEnvironment(ctx, "example", &azuredevops.EnvironmentArgs{
			ProjectId: example.ID(),
			Name:      pulumi.String("Example Environment"),
		})
		if err != nil {
			return err
		}
		_, err = azuredevops.NewCheckBranchControl(ctx, "example", &azuredevops.CheckBranchControlArgs{
			ProjectId:          example.ID(),
			DisplayName:        pulumi.String("Managed by Pulumi"),
			TargetResourceId:   exampleEnvironment.ID(),
			TargetResourceType: pulumi.String("environment"),
			AllowedBranches:    pulumi.String("refs/heads/main, refs/heads/features/*"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureDevOps = Pulumi.AzureDevOps;

return await Deployment.RunAsync(() => 
{
    var example = new AzureDevOps.Project("example", new()
    {
        Name = "Example Project",
    });

    var exampleEnvironment = new AzureDevOps.Environment("example", new()
    {
        ProjectId = example.Id,
        Name = "Example Environment",
    });

    var exampleCheckBranchControl = new AzureDevOps.CheckBranchControl("example", new()
    {
        ProjectId = example.Id,
        DisplayName = "Managed by Pulumi",
        TargetResourceId = exampleEnvironment.Id,
        TargetResourceType = "environment",
        AllowedBranches = "refs/heads/main, refs/heads/features/*",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuredevops.Project;
import com.pulumi.azuredevops.ProjectArgs;
import com.pulumi.azuredevops.Environment;
import com.pulumi.azuredevops.EnvironmentArgs;
import com.pulumi.azuredevops.CheckBranchControl;
import com.pulumi.azuredevops.CheckBranchControlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Project("example", ProjectArgs.builder()
            .name("Example Project")
            .build());

        var exampleEnvironment = new Environment("exampleEnvironment", EnvironmentArgs.builder()
            .projectId(example.id())
            .name("Example Environment")
            .build());

        var exampleCheckBranchControl = new CheckBranchControl("exampleCheckBranchControl", CheckBranchControlArgs.builder()
            .projectId(example.id())
            .displayName("Managed by Pulumi")
            .targetResourceId(exampleEnvironment.id())
            .targetResourceType("environment")
            .allowedBranches("refs/heads/main, refs/heads/features/*")
            .build());

    }
}

    resources:
  example:
    type: azuredevops:Project
    properties:
      name: Example Project
  exampleEnvironment:
    type: azuredevops:Environment
    name: example
    properties:
      projectId: ${example.id}
      name: Example Environment
  exampleCheckBranchControl:
    type: azuredevops:CheckBranchControl
    name: example
    properties:
      projectId: ${example.id}
      displayName: Managed by Pulumi
      targetResourceId: ${exampleEnvironment.id}
      targetResourceType: environment
      allowedBranches: refs/heads/main, refs/heads/features/*

    Protect an agent queue

    import * as pulumi from "@pulumi/pulumi";
import * as azuredevops from "@pulumi/azuredevops";

const example = new azuredevops.Project("example", {name: "Example Project"});
const examplePool = new azuredevops.Pool("example", {name: "example-pool"});
const exampleQueue = new azuredevops.Queue("example", {
    projectId: example.id,
    agentPoolId: examplePool.id,
});
const exampleCheckBranchControl = new azuredevops.CheckBranchControl("example", {
    projectId: example.id,
    displayName: "Managed by Pulumi",
    targetResourceId: exampleQueue.id,
    targetResourceType: "queue",
    allowedBranches: "refs/heads/main, refs/heads/features/*",
});

    import pulumi
import pulumi_azuredevops as azuredevops

example = azuredevops.Project("example", name="Example Project")
example_pool = azuredevops.Pool("example", name="example-pool")
example_queue = azuredevops.Queue("example",
    project_id=example.id,
    agent_pool_id=example_pool.id)
example_check_branch_control = azuredevops.CheckBranchControl("example",
    project_id=example.id,
    display_name="Managed by Pulumi",
    target_resource_id=example_queue.id,
    target_resource_type="queue",
    allowed_branches="refs/heads/main, refs/heads/features/*")

    package main

import (
	"github.com/pulumi/pulumi-azuredevops/sdk/v3/go/azuredevops"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := azuredevops.NewProject(ctx, "example", &azuredevops.ProjectArgs{
			Name: pulumi.String("Example Project"),
		})
		if err != nil {
			return err
		}
		examplePool, err := azuredevops.NewPool(ctx, "example", &azuredevops.PoolArgs{
			Name: pulumi.String("example-pool"),
		})
		if err != nil {
			return err
		}
		exampleQueue, err := azuredevops.NewQueue(ctx, "example", &azuredevops.QueueArgs{
			ProjectId:   example.ID(),
			AgentPoolId: examplePool.ID(),
		})
		if err != nil {
			return err
		}
		_, err = azuredevops.NewCheckBranchControl(ctx, "example", &azuredevops.CheckBranchControlArgs{
			ProjectId:          example.ID(),
			DisplayName:        pulumi.String("Managed by Pulumi"),
			TargetResourceId:   exampleQueue.ID(),
			TargetResourceType: pulumi.String("queue"),
			AllowedBranches:    pulumi.String("refs/heads/main, refs/heads/features/*"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureDevOps = Pulumi.AzureDevOps;

return await Deployment.RunAsync(() => 
{
    var example = new AzureDevOps.Project("example", new()
    {
        Name = "Example Project",
    });

    var examplePool = new AzureDevOps.Pool("example", new()
    {
        Name = "example-pool",
    });

    var exampleQueue = new AzureDevOps.Queue("example", new()
    {
        ProjectId = example.Id,
        AgentPoolId = examplePool.Id,
    });

    var exampleCheckBranchControl = new AzureDevOps.CheckBranchControl("example", new()
    {
        ProjectId = example.Id,
        DisplayName = "Managed by Pulumi",
        TargetResourceId = exampleQueue.Id,
        TargetResourceType = "queue",
        AllowedBranches = "refs/heads/main, refs/heads/features/*",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuredevops.Project;
import com.pulumi.azuredevops.ProjectArgs;
import com.pulumi.azuredevops.Pool;
import com.pulumi.azuredevops.PoolArgs;
import com.pulumi.azuredevops.Queue;
import com.pulumi.azuredevops.QueueArgs;
import com.pulumi.azuredevops.CheckBranchControl;
import com.pulumi.azuredevops.CheckBranchControlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Project("example", ProjectArgs.builder()
            .name("Example Project")
            .build());

        var examplePool = new Pool("examplePool", PoolArgs.builder()
            .name("example-pool")
            .build());

        var exampleQueue = new Queue("exampleQueue", QueueArgs.builder()
            .projectId(example.id())
            .agentPoolId(examplePool.id())
            .build());

        var exampleCheckBranchControl = new CheckBranchControl("exampleCheckBranchControl", CheckBranchControlArgs.builder()
            .projectId(example.id())
            .displayName("Managed by Pulumi")
            .targetResourceId(exampleQueue.id())
            .targetResourceType("queue")
            .allowedBranches("refs/heads/main, refs/heads/features/*")
            .build());

    }
}

    resources:
  example:
    type: azuredevops:Project
    properties:
      name: Example Project
  examplePool:
    type: azuredevops:Pool
    name: example
    properties:
      name: example-pool
  exampleQueue:
    type: azuredevops:Queue
    name: example
    properties:
      projectId: ${example.id}
      agentPoolId: ${examplePool.id}
  exampleCheckBranchControl:
    type: azuredevops:CheckBranchControl
    name: example
    properties:
      projectId: ${example.id}
      displayName: Managed by Pulumi
      targetResourceId: ${exampleQueue.id}
      targetResourceType: queue
      allowedBranches: refs/heads/main, refs/heads/features/*

    Protect a repository

    import * as pulumi from "@pulumi/pulumi";
import * as azuredevops from "@pulumi/azuredevops";

const example = new azuredevops.Project("example", {name: "Example Project"});
const exampleGit = new azuredevops.Git("example", {
    projectId: example.id,
    name: "Example Empty Git Repository",
    initialization: {
        initType: "Clean",
    },
});
const exampleCheckBranchControl = new azuredevops.CheckBranchControl("example", {
    projectId: example.id,
    displayName: "Managed by Pulumi",
    targetResourceId: pulumi.interpolate`${example.id}.${exampleGit.id}`,
    targetResourceType: "repository",
    allowedBranches: "refs/heads/main, refs/heads/features/*",
});

    import pulumi
import pulumi_azuredevops as azuredevops

example = azuredevops.Project("example", name="Example Project")
example_git = azuredevops.Git("example",
    project_id=example.id,
    name="Example Empty Git Repository",
    initialization={
        "init_type": "Clean",
    })
example_check_branch_control = azuredevops.CheckBranchControl("example",
    project_id=example.id,
    display_name="Managed by Pulumi",
    target_resource_id=pulumi.Output.all(
        exampleId=example.id,
        exampleGitId=example_git.id
).apply(lambda resolved_outputs: f"{resolved_outputs['exampleId']}.{resolved_outputs['exampleGitId']}")
,
    target_resource_type="repository",
    allowed_branches="refs/heads/main, refs/heads/features/*")

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-azuredevops/sdk/v3/go/azuredevops"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := azuredevops.NewProject(ctx, "example", &azuredevops.ProjectArgs{
			Name: pulumi.String("Example Project"),
		})
		if err != nil {
			return err
		}
		exampleGit, err := azuredevops.NewGit(ctx, "example", &azuredevops.GitArgs{
			ProjectId: example.ID(),
			Name:      pulumi.String("Example Empty Git Repository"),
			Initialization: &azuredevops.GitInitializationArgs{
				InitType: pulumi.String("Clean"),
			},
		})
		if err != nil {
			return err
		}
		_, err = azuredevops.NewCheckBranchControl(ctx, "example", &azuredevops.CheckBranchControlArgs{
			ProjectId:   example.ID(),
			DisplayName: pulumi.String("Managed by Pulumi"),
			TargetResourceId: pulumi.All(example.ID(), exampleGit.ID()).ApplyT(func(_args []interface{}) (string, error) {
				exampleId := _args[0].(string)
				exampleGitId := _args[1].(string)
				return fmt.Sprintf("%v.%v", exampleId, exampleGitId), nil
			}).(pulumi.StringOutput),
			TargetResourceType: pulumi.String("repository"),
			AllowedBranches:    pulumi.String("refs/heads/main, refs/heads/features/*"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureDevOps = Pulumi.AzureDevOps;

return await Deployment.RunAsync(() => 
{
    var example = new AzureDevOps.Project("example", new()
    {
        Name = "Example Project",
    });

    var exampleGit = new AzureDevOps.Git("example", new()
    {
        ProjectId = example.Id,
        Name = "Example Empty Git Repository",
        Initialization = new AzureDevOps.Inputs.GitInitializationArgs
        {
            InitType = "Clean",
        },
    });

    var exampleCheckBranchControl = new AzureDevOps.CheckBranchControl("example", new()
    {
        ProjectId = example.Id,
        DisplayName = "Managed by Pulumi",
        TargetResourceId = Output.Tuple(example.Id, exampleGit.Id).Apply(values =>
        {
            var exampleId = values.Item1;
            var exampleGitId = values.Item2;
            return $"{exampleId}.{exampleGitId}";
        }),
        TargetResourceType = "repository",
        AllowedBranches = "refs/heads/main, refs/heads/features/*",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuredevops.Project;
import com.pulumi.azuredevops.ProjectArgs;
import com.pulumi.azuredevops.Git;
import com.pulumi.azuredevops.GitArgs;
import com.pulumi.azuredevops.inputs.GitInitializationArgs;
import com.pulumi.azuredevops.CheckBranchControl;
import com.pulumi.azuredevops.CheckBranchControlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Project("example", ProjectArgs.builder()
            .name("Example Project")
            .build());

        var exampleGit = new Git("exampleGit", GitArgs.builder()
            .projectId(example.id())
            .name("Example Empty Git Repository")
            .initialization(GitInitializationArgs.builder()
                .initType("Clean")
                .build())
            .build());

        var exampleCheckBranchControl = new CheckBranchControl("exampleCheckBranchControl", CheckBranchControlArgs.builder()
            .projectId(example.id())
            .displayName("Managed by Pulumi")
            .targetResourceId(Output.tuple(example.id(), exampleGit.id()).applyValue(values -> {
                var exampleId = values.t1;
                var exampleGitId = values.t2;
                return String.format("%s.%s", exampleId,exampleGitId);
            }))
            .targetResourceType("repository")
            .allowedBranches("refs/heads/main, refs/heads/features/*")
            .build());

    }
}

    resources:
  example:
    type: azuredevops:Project
    properties:
      name: Example Project
  exampleGit:
    type: azuredevops:Git
    name: example
    properties:
      projectId: ${example.id}
      name: Example Empty Git Repository
      initialization:
        initType: Clean
  exampleCheckBranchControl:
    type: azuredevops:CheckBranchControl
    name: example
    properties:
      projectId: ${example.id}
      displayName: Managed by Pulumi
      targetResourceId: ${example.id}.${exampleGit.id}
      targetResourceType: repository
      allowedBranches: refs/heads/main, refs/heads/features/*

    Protect a variable group

    import * as pulumi from "@pulumi/pulumi";
import * as azuredevops from "@pulumi/azuredevops";

const example = new azuredevops.Project("example", {name: "Example Project"});
const exampleVariableGroup = new azuredevops.VariableGroup("example", {
    projectId: example.id,
    name: "Example Variable Group",
    description: "Example Variable Group Description",
    allowAccess: true,
    variables: [
        {
            name: "key1",
            value: "val1",
        },
        {
            name: "key2",
            secretValue: "val2",
            isSecret: true,
        },
    ],
});
const exampleCheckBranchControl = new azuredevops.CheckBranchControl("example", {
    projectId: example.id,
    displayName: "Managed by Pulumi",
    targetResourceId: exampleVariableGroup.id,
    targetResourceType: "variablegroup",
    allowedBranches: "refs/heads/main, refs/heads/features/*",
});

    import pulumi
import pulumi_azuredevops as azuredevops

example = azuredevops.Project("example", name="Example Project")
example_variable_group = azuredevops.VariableGroup("example",
    project_id=example.id,
    name="Example Variable Group",
    description="Example Variable Group Description",
    allow_access=True,
    variables=[
        {
            "name": "key1",
            "value": "val1",
        },
        {
            "name": "key2",
            "secret_value": "val2",
            "is_secret": True,
        },
    ])
example_check_branch_control = azuredevops.CheckBranchControl("example",
    project_id=example.id,
    display_name="Managed by Pulumi",
    target_resource_id=example_variable_group.id,
    target_resource_type="variablegroup",
    allowed_branches="refs/heads/main, refs/heads/features/*")

    package main

import (
	"github.com/pulumi/pulumi-azuredevops/sdk/v3/go/azuredevops"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := azuredevops.NewProject(ctx, "example", &azuredevops.ProjectArgs{
			Name: pulumi.String("Example Project"),
		})
		if err != nil {
			return err
		}
		exampleVariableGroup, err := azuredevops.NewVariableGroup(ctx, "example", &azuredevops.VariableGroupArgs{
			ProjectId:   example.ID(),
			Name:        pulumi.String("Example Variable Group"),
			Description: pulumi.String("Example Variable Group Description"),
			AllowAccess: pulumi.Bool(true),
			Variables: azuredevops.VariableGroupVariableArray{
				&azuredevops.VariableGroupVariableArgs{
					Name:  pulumi.String("key1"),
					Value: pulumi.String("val1"),
				},
				&azuredevops.VariableGroupVariableArgs{
					Name:        pulumi.String("key2"),
					SecretValue: pulumi.String("val2"),
					IsSecret:    pulumi.Bool(true),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = azuredevops.NewCheckBranchControl(ctx, "example", &azuredevops.CheckBranchControlArgs{
			ProjectId:          example.ID(),
			DisplayName:        pulumi.String("Managed by Pulumi"),
			TargetResourceId:   exampleVariableGroup.ID(),
			TargetResourceType: pulumi.String("variablegroup"),
			AllowedBranches:    pulumi.String("refs/heads/main, refs/heads/features/*"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureDevOps = Pulumi.AzureDevOps;

return await Deployment.RunAsync(() => 
{
    var example = new AzureDevOps.Project("example", new()
    {
        Name = "Example Project",
    });

    var exampleVariableGroup = new AzureDevOps.VariableGroup("example", new()
    {
        ProjectId = example.Id,
        Name = "Example Variable Group",
        Description = "Example Variable Group Description",
        AllowAccess = true,
        Variables = new[]
        {
            new AzureDevOps.Inputs.VariableGroupVariableArgs
            {
                Name = "key1",
                Value = "val1",
            },
            new AzureDevOps.Inputs.VariableGroupVariableArgs
            {
                Name = "key2",
                SecretValue = "val2",
                IsSecret = true,
            },
        },
    });

    var exampleCheckBranchControl = new AzureDevOps.CheckBranchControl("example", new()
    {
        ProjectId = example.Id,
        DisplayName = "Managed by Pulumi",
        TargetResourceId = exampleVariableGroup.Id,
        TargetResourceType = "variablegroup",
        AllowedBranches = "refs/heads/main, refs/heads/features/*",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azuredevops.Project;
import com.pulumi.azuredevops.ProjectArgs;
import com.pulumi.azuredevops.VariableGroup;
import com.pulumi.azuredevops.VariableGroupArgs;
import com.pulumi.azuredevops.inputs.VariableGroupVariableArgs;
import com.pulumi.azuredevops.CheckBranchControl;
import com.pulumi.azuredevops.CheckBranchControlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Project("example", ProjectArgs.builder()
            .name("Example Project")
            .build());

        var exampleVariableGroup = new VariableGroup("exampleVariableGroup", VariableGroupArgs.builder()
            .projectId(example.id())
            .name("Example Variable Group")
            .description("Example Variable Group Description")
            .allowAccess(true)
            .variables(            
                VariableGroupVariableArgs.builder()
                    .name("key1")
                    .value("val1")
                    .build(),
                VariableGroupVariableArgs.builder()
                    .name("key2")
                    .secretValue("val2")
                    .isSecret(true)
                    .build())
            .build());

        var exampleCheckBranchControl = new CheckBranchControl("exampleCheckBranchControl", CheckBranchControlArgs.builder()
            .projectId(example.id())
            .displayName("Managed by Pulumi")
            .targetResourceId(exampleVariableGroup.id())
            .targetResourceType("variablegroup")
            .allowedBranches("refs/heads/main, refs/heads/features/*")
            .build());

    }
}

    resources:
  example:
    type: azuredevops:Project
    properties:
      name: Example Project
  exampleVariableGroup:
    type: azuredevops:VariableGroup
    name: example
    properties:
      projectId: ${example.id}
      name: Example Variable Group
      description: Example Variable Group Description
      allowAccess: true
      variables:
        - name: key1
          value: val1
        - name: key2
          secretValue: val2
          isSecret: true
  exampleCheckBranchControl:
    type: azuredevops:CheckBranchControl
    name: example
    properties:
      projectId: ${example.id}
      displayName: Managed by Pulumi
      targetResourceId: ${exampleVariableGroup.id}
      targetResourceType: variablegroup
      allowedBranches: refs/heads/main, refs/heads/features/*

    Create CheckBranchControl Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new CheckBranchControl(name: string, args: CheckBranchControlArgs, opts?: CustomResourceOptions);
    @overload
def CheckBranchControl(resource_name: str,
                       args: CheckBranchControlArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def CheckBranchControl(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       project_id: Optional[str] = None,
                       target_resource_id: Optional[str] = None,
                       target_resource_type: Optional[str] = None,
                       allowed_branches: Optional[str] = None,
                       display_name: Optional[str] = None,
                       ignore_unknown_protection_status: Optional[bool] = None,
                       timeout: Optional[int] = None,
                       verify_branch_protection: Optional[bool] = None)
    func NewCheckBranchControl(ctx *Context, name string, args CheckBranchControlArgs, opts ...ResourceOption) (*CheckBranchControl, error)
    public CheckBranchControl(string name, CheckBranchControlArgs args, CustomResourceOptions? opts = null)
    public CheckBranchControl(String name, CheckBranchControlArgs args)
public CheckBranchControl(String name, CheckBranchControlArgs args, CustomResourceOptions options)

    type: azuredevops:CheckBranchControl
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args CheckBranchControlArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CheckBranchControlArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CheckBranchControlArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CheckBranchControlArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CheckBranchControlArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var checkBranchControlResource = new AzureDevOps.CheckBranchControl("checkBranchControlResource", new()
{
    ProjectId = "string",
    TargetResourceId = "string",
    TargetResourceType = "string",
    AllowedBranches = "string",
    DisplayName = "string",
    IgnoreUnknownProtectionStatus = false,
    Timeout = 0,
    VerifyBranchProtection = false,
});

    example, err := azuredevops.NewCheckBranchControl(ctx, "checkBranchControlResource", &azuredevops.CheckBranchControlArgs{
	ProjectId:                     pulumi.String("string"),
	TargetResourceId:              pulumi.String("string"),
	TargetResourceType:            pulumi.String("string"),
	AllowedBranches:               pulumi.String("string"),
	DisplayName:                   pulumi.String("string"),
	IgnoreUnknownProtectionStatus: pulumi.Bool(false),
	Timeout:                       pulumi.Int(0),
	VerifyBranchProtection:        pulumi.Bool(false),
})

    var checkBranchControlResource = new CheckBranchControl("checkBranchControlResource", CheckBranchControlArgs.builder()
    .projectId("string")
    .targetResourceId("string")
    .targetResourceType("string")
    .allowedBranches("string")
    .displayName("string")
    .ignoreUnknownProtectionStatus(false)
    .timeout(0)
    .verifyBranchProtection(false)
    .build());

    check_branch_control_resource = azuredevops.CheckBranchControl("checkBranchControlResource",
    project_id="string",
    target_resource_id="string",
    target_resource_type="string",
    allowed_branches="string",
    display_name="string",
    ignore_unknown_protection_status=False,
    timeout=0,
    verify_branch_protection=False)

    const checkBranchControlResource = new azuredevops.CheckBranchControl("checkBranchControlResource", {
    projectId: "string",
    targetResourceId: "string",
    targetResourceType: "string",
    allowedBranches: "string",
    displayName: "string",
    ignoreUnknownProtectionStatus: false,
    timeout: 0,
    verifyBranchProtection: false,
});

    type: azuredevops:CheckBranchControl
properties:
    allowedBranches: string
    displayName: string
    ignoreUnknownProtectionStatus: false
    projectId: string
    targetResourceId: string
    targetResourceType: string
    timeout: 0
    verifyBranchProtection: false

    CheckBranchControl Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The CheckBranchControl resource accepts the following input properties:

    ProjectId string
    The project ID.
    TargetResourceId string
    The ID of the resource being protected by the check.
    TargetResourceType string
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    AllowedBranches string
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    DisplayName string
    The name of the branch control check displayed in the web UI.
    IgnoreUnknownProtectionStatus bool
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    Timeout int
    The timeout in minutes for the branch control check. Defaults to 1440.
    VerifyBranchProtection bool
    Validate the branches being deployed are protected. Defaults to false.
    ProjectId string
    The project ID.
    TargetResourceId string
    The ID of the resource being protected by the check.
    TargetResourceType string
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    AllowedBranches string
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    DisplayName string
    The name of the branch control check displayed in the web UI.
    IgnoreUnknownProtectionStatus bool
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    Timeout int
    The timeout in minutes for the branch control check. Defaults to 1440.
    VerifyBranchProtection bool
    Validate the branches being deployed are protected. Defaults to false.
    projectId String
    The project ID.
    targetResourceId String
    The ID of the resource being protected by the check.
    targetResourceType String
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    allowedBranches String
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    displayName String
    The name of the branch control check displayed in the web UI.
    ignoreUnknownProtectionStatus Boolean
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    timeout Integer
    The timeout in minutes for the branch control check. Defaults to 1440.
    verifyBranchProtection Boolean
    Validate the branches being deployed are protected. Defaults to false.
    projectId string
    The project ID.
    targetResourceId string
    The ID of the resource being protected by the check.
    targetResourceType string
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    allowedBranches string
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    displayName string
    The name of the branch control check displayed in the web UI.
    ignoreUnknownProtectionStatus boolean
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    timeout number
    The timeout in minutes for the branch control check. Defaults to 1440.
    verifyBranchProtection boolean
    Validate the branches being deployed are protected. Defaults to false.
    project_id str
    The project ID.
    target_resource_id str
    The ID of the resource being protected by the check.
    target_resource_type str
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    allowed_branches str
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    display_name str
    The name of the branch control check displayed in the web UI.
    ignore_unknown_protection_status bool
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    timeout int
    The timeout in minutes for the branch control check. Defaults to 1440.
    verify_branch_protection bool
    Validate the branches being deployed are protected. Defaults to false.
    projectId String
    The project ID.
    targetResourceId String
    The ID of the resource being protected by the check.
    targetResourceType String
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    allowedBranches String
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    displayName String
    The name of the branch control check displayed in the web UI.
    ignoreUnknownProtectionStatus Boolean
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    timeout Number
    The timeout in minutes for the branch control check. Defaults to 1440.
    verifyBranchProtection Boolean
    Validate the branches being deployed are protected. Defaults to false.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CheckBranchControl resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Version int
    The version of the check.
    Id string
    The provider-assigned unique ID for this managed resource.
    Version int
    The version of the check.
    id String
    The provider-assigned unique ID for this managed resource.
    version Integer
    The version of the check.
    id string
    The provider-assigned unique ID for this managed resource.
    version number
    The version of the check.
    id str
    The provider-assigned unique ID for this managed resource.
    version int
    The version of the check.
    id String
    The provider-assigned unique ID for this managed resource.
    version Number
    The version of the check.

    Look up Existing CheckBranchControl Resource

    Get an existing CheckBranchControl resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: CheckBranchControlState, opts?: CustomResourceOptions): CheckBranchControl
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        allowed_branches: Optional[str] = None,
        display_name: Optional[str] = None,
        ignore_unknown_protection_status: Optional[bool] = None,
        project_id: Optional[str] = None,
        target_resource_id: Optional[str] = None,
        target_resource_type: Optional[str] = None,
        timeout: Optional[int] = None,
        verify_branch_protection: Optional[bool] = None,
        version: Optional[int] = None) -> CheckBranchControl
    func GetCheckBranchControl(ctx *Context, name string, id IDInput, state *CheckBranchControlState, opts ...ResourceOption) (*CheckBranchControl, error)
    public static CheckBranchControl Get(string name, Input<string> id, CheckBranchControlState? state, CustomResourceOptions? opts = null)
    public static CheckBranchControl get(String name, Output<String> id, CheckBranchControlState state, CustomResourceOptions options)
    resources:  _:    type: azuredevops:CheckBranchControl    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AllowedBranches string
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    DisplayName string
    The name of the branch control check displayed in the web UI.
    IgnoreUnknownProtectionStatus bool
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    ProjectId string
    The project ID.
    TargetResourceId string
    The ID of the resource being protected by the check.
    TargetResourceType string
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    Timeout int
    The timeout in minutes for the branch control check. Defaults to 1440.
    VerifyBranchProtection bool
    Validate the branches being deployed are protected. Defaults to false.
    Version int
    The version of the check.
    AllowedBranches string
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    DisplayName string
    The name of the branch control check displayed in the web UI.
    IgnoreUnknownProtectionStatus bool
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    ProjectId string
    The project ID.
    TargetResourceId string
    The ID of the resource being protected by the check.
    TargetResourceType string
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    Timeout int
    The timeout in minutes for the branch control check. Defaults to 1440.
    VerifyBranchProtection bool
    Validate the branches being deployed are protected. Defaults to false.
    Version int
    The version of the check.
    allowedBranches String
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    displayName String
    The name of the branch control check displayed in the web UI.
    ignoreUnknownProtectionStatus Boolean
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    projectId String
    The project ID.
    targetResourceId String
    The ID of the resource being protected by the check.
    targetResourceType String
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    timeout Integer
    The timeout in minutes for the branch control check. Defaults to 1440.
    verifyBranchProtection Boolean
    Validate the branches being deployed are protected. Defaults to false.
    version Integer
    The version of the check.
    allowedBranches string
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    displayName string
    The name of the branch control check displayed in the web UI.
    ignoreUnknownProtectionStatus boolean
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    projectId string
    The project ID.
    targetResourceId string
    The ID of the resource being protected by the check.
    targetResourceType string
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    timeout number
    The timeout in minutes for the branch control check. Defaults to 1440.
    verifyBranchProtection boolean
    Validate the branches being deployed are protected. Defaults to false.
    version number
    The version of the check.
    allowed_branches str
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    display_name str
    The name of the branch control check displayed in the web UI.
    ignore_unknown_protection_status bool
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    project_id str
    The project ID.
    target_resource_id str
    The ID of the resource being protected by the check.
    target_resource_type str
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    timeout int
    The timeout in minutes for the branch control check. Defaults to 1440.
    verify_branch_protection bool
    Validate the branches being deployed are protected. Defaults to false.
    version int
    The version of the check.
    allowedBranches String
    The branches allowed to use the resource. Specify a comma separated list of allowed branches in refs/heads/branch_name format. To allow deployments from all branches, specify * . refs/heads/features/* , refs/heads/releases/* restricts deployments to all branches under features/ or releases/ . Defaults to *.
    displayName String
    The name of the branch control check displayed in the web UI.
    ignoreUnknownProtectionStatus Boolean
    Allow deployment from branches for which protection status could not be obtained. Only relevant when verify_branch_protection is true. Defaults to false.
    projectId String
    The project ID.
    targetResourceId String
    The ID of the resource being protected by the check.
    targetResourceType String
    The type of resource being protected by the check. Possible values are: endpoint, environment, queue, repository, securefile, variablegroup.
    timeout Number
    The timeout in minutes for the branch control check. Defaults to 1440.
    verifyBranchProtection Boolean
    Validate the branches being deployed are protected. Defaults to false.
    version Number
    The version of the check.

    Import

    Importing this resource is not supported.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure DevOps pulumi/pulumi-azuredevops
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azuredevops Terraform Provider.
    azuredevops logo
    Azure DevOps v3.8.0 published on Monday, Mar 17, 2025 by Pulumi
    pulumi/pulumi-azuredevops