An includes template pastes its steps into your pipeline file. An extends template defines the outer structure and lets teams add steps only at points you allow. Microsoft's guidance says that for the most secure pipelines, start with extends templates, and anchor them to a branch or tag.
Two ways to reuse
Microsoft's documentation on templates for security describes two kinds. An includes template inserts the template's code directly into the file that references it, similar to an include in C++. An extends template defines the outer structure of the pipeline and exposes specific points for customization, closer to inheritance.
When you adopt a shared or public template, that difference decides how much control the consuming team keeps.
Side by side
| Property | Includes template | Extends template |
|---|---|---|
| Who owns the outer structure | The consuming pipeline | The template |
| Can the team add arbitrary steps | Yes | Only where parameters allow |
| Good for | Reusing a common step block | Enforcing a required shape |
| Security effect | Convenience | Helps prevent malicious code infiltration, per Microsoft |
What an extends template can enforce
Microsoft lists several built in protections you can use inside an extends template:
- Step targets. Restrict specified steps to run in a container instead of on the host, so they cannot modify agent configuration or leave code behind for later runs. A container can also limit network access.
- Type safe parameters. Parameters can enumerate allowed values, such as a fixed list of agent pools, rather than accepting any string.
- Required steps. The template can include steps that always run, such as credential scanning.
Pin the template
The documentation's own tip is to anchor an extends template to a particular Git branch or tag, so breaking changes do not affect existing pipelines. Its example references a template repository at a tag. Treat that reference like a dependency version: choose it on purpose and change it through review.
Checks on protected resources
Microsoft says templates can help enforce checks on protected resources, which form the foundation of the security model for Azure Pipelines. Pairing an extends template with a required template check means a pipeline that does not extend your template cannot use the protected resource. See the required template check for the setup.
How to adopt a shared template safely
- Read it end to end, including every parameter.
- Check which steps run on the host and which run in containers.
- Pin the reference to a tag or branch you control.
- Decide which customization points teams really need and keep them few.
- Put the template repository behind pull requests and code owners.
- Test in a sandbox project before you require it.
Quick check
Does an extends template stop all misuse?
No. It limits where teams can add steps and what those steps can reach. It does not review the content of steps teams are allowed to add.
Should I convert every includes template to an extends template?
Not necessarily. Includes work fine for reusable step blocks. Use extends where you need to guarantee structure, such as production deploy pipelines.
Sources
Last reviewed: 19 October 2026.
