Pipelines: infrastructure as code · Topic 2 of 2
Desired State Configuration and Azure Deployment Environments
AZ-400 desired state: PowerShell DSC, Automation State Configuration, Azure Machine Configuration with Policy, and Azure Deployment Environments.
- 6 min
- Desired state: declare, detect drift, report or correct. DSC uses configurations, LCM and MOF files.
- Azure Automation State Configuration is a hosted DSC pull service that retires on September 30, 2027. Azure Machine Configuration is the Azure Policy based way to audit and enforce settings inside machines, including Arc servers.
- ADE has dev center, catalog, project, environment type and environment. Environments deploy using the environment type's identity.
What it is
Desired state configuration means you declare how a system should look and a tool makes it so, and keeps it so. If someone changes a setting by hand, the tool detects the drift and reports it or corrects it.
Azure Deployment Environments (ADE) solves a different problem: letting developers create complete, approved environments on demand from templates that the platform team controls, without giving them broad Azure rights.
How it works
Desired state for Azure resources
Resource definitions in ARM templates and Bicep are desired state for Azure resources. Redeploying the template brings resources back to the declared shape. Azure Policy adds a guard that audits or blocks resources that violate rules. For Kubernetes, GitOps with Flux (available as an AKS extension) keeps the cluster in line with manifests in a Git repository.
PowerShell DSC
PowerShell Desired State Configuration (DSC) configures settings inside an operating system.
| Part | Role |
|---|---|
| Configuration | A declarative script that lists resources, such as a Windows feature, a service state, a file or a registry value |
| Resources | The building blocks that know how to test and set one thing |
| MOF file | The compiled configuration that is delivered to a node |
| Local Configuration Manager (LCM) | The engine on each machine that applies the configuration. Its mode decides what happens on drift: apply once, apply and monitor, or apply and auto correct |
DSC can run in push mode (you send the configuration) or pull mode (the node fetches it from a pull server).
Azure Automation State Configuration
Azure Automation State Configuration is a cloud hosted DSC pull service. You upload and compile configurations, onboard nodes (Azure virtual machines or machines elsewhere), assign a node configuration and read compliance reports in the portal. Microsoft has announced that it retires on September 30, 2027 and tells customers to move to Azure Machine Configuration, but the Automation service is still named in the exam outline.
Azure Machine Configuration
Azure Machine Configuration (formerly Guest Configuration) audits and optionally configures settings inside machines, on Azure VMs and Azure Arc enabled servers, on Windows and Linux.
| Feature | Notes |
|---|---|
| Delivery | An extension on the machine downloads a configuration package and evaluates it |
| Policy integration | Machine Configuration runs through Azure Policy. Built in and custom policy definitions assign the checks, and compliance appears in Azure Policy |
| Audit or enforce | Many built in policies only audit. Configurations that use DeployIfNotExists and the ApplyAndAutoCorrect behavior can fix drift |
| Custom content | Write DSC based configurations, package them (for example with the GuestConfiguration PowerShell module), host the package and create the policy |
| Identity | The machine needs a managed identity so the service can work. Policy initiatives can assign one |
Use it to answer questions such as "are all servers using TLS 1.2 only?" and to keep settings aligned across Azure and hybrid machines.
Comparing the options
| Need | Choice |
|---|---|
| Declare Azure resources | ARM or Bicep |
| Enforce rules on resource properties | Azure Policy |
| Audit or enforce settings inside VMs at scale, including Arc servers | Azure Machine Configuration |
| Existing DSC pull model for Windows nodes | Azure Automation State Configuration |
| Keep Kubernetes in line with Git | GitOps with Flux |
Azure Deployment Environments
ADE gives developers self-service infrastructure with guardrails.
| Concept | Meaning |
|---|---|
| Dev center | The top level resource that holds catalogs and environment types |
| Catalog | A Git repository (GitHub or Azure Repos) holding environment definitions: IaC templates such as ARM or Bicep, plus a manifest file that describes them |
| Project | A team's workspace, linked to the dev center, where environments are created |
| Environment type | A stage such as dev, test or production. Each maps to an Azure subscription and a managed identity with set permissions, and defines who may create them |
| Environment | A deployed instance of a definition |
Flow: platform engineers publish approved templates in the catalog and set environment types. A developer creates an environment from the developer portal, the CLI or a pipeline, chooses a definition, and ADE deploys it into the mapped subscription using the environment type's identity, so developers do not need Owner or Contributor on the subscription. Expiration and deletion settings help control cost, and cost tracking is per environment.
Common uses: short lived test environments per pull request, onboarding a new developer with a ready environment, and giving teams consistent production like stacks. In CI/CD you can create an environment, run integration tests and delete it.
A worked scenario
A company wants each pull request to get its own environment with a database and web app, deleted automatically afterwards, without developers holding rights in the production subscription. The platform team creates a dev center with a catalog of Bicep definitions, a project per team and a test environment type mapped to a sandbox subscription. The pipeline creates an environment on pull request open, runs tests and deletes it on close. Separately, Azure Machine Configuration audits that the VMs inside those stacks use approved settings.
What to remember for the exam
- Desired state: declare, detect drift, report or correct. DSC uses configurations, LCM and MOF files.
- Azure Automation State Configuration is a hosted DSC pull service that retires on September 30, 2027. Azure Machine Configuration is the Azure Policy based way to audit and enforce settings inside machines, including Arc servers.
- ADE has dev center, catalog, project, environment type and environment. Environments deploy using the environment type's identity.
- ADE definitions come from a Git catalog, written as IaC templates.
- Use expiration to control cost for temporary environments.
"Audit settings inside VMs with Azure Policy" is Machine Configuration. "Give developers self-service environments with guardrails" is Azure Deployment Environments.
How the exam asks about this
- "Detect when a server's local security setting drifts from the standard." Azure Machine Configuration or DSC.
- "Developers create approved environments on demand without subscription rights." Azure Deployment Environments.
- "Where do ADE templates live?" In a catalog backed by a Git repository.
- "Correct drift automatically in DSC." A Local Configuration Manager mode of apply and auto correct.
Common mistakes
Mixing up Azure Policy and Machine Configuration. Policy checks Azure resource properties. Machine Configuration reaches inside the operating system, through Policy.
Giving developers subscription rights. ADE exists to avoid that.
Forgetting to expire environments. Temporary environments left running cost money.
Assuming DSC fixes drift by default. The LCM mode decides.
Check yourself
Which engine on a machine applies a DSC configuration?
The Local Configuration Manager.
Which service audits settings inside Azure and Arc enabled machines through Azure Policy?
Azure Machine Configuration.
What does an ADE environment type map to?
An Azure subscription and a managed identity with set permissions.
Topic 2 of 2 in Pipelines: infrastructure as code
Test yourself on Pipelines: infrastructure as code
The full Microsoft AZ-400 question bank has 766 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.