Microsoft released September 2023 patches for Azure DevOps Server 2022 and 2020, updating the self-hosted platform with security fixes and reliability improvements. These cumulative updates are now available for download and address reported vulnerabilities in the server components. Staying current with these patches ensures compliance with Microsoft's support lifecycle and reduces exposure to known exploits targeting on-premises DevOps infrastructure.
Which Versions Received Updates
Azure DevOps Server 2022 Update 1.2 received the September 2023 patch, bringing the build number to 17.153.29411.4. This update includes fixes for server-side components affecting pipeline execution and artifact handling.
Azure DevOps Server 2020 Update 1.1 was also patched in this release, advancing to build 16.153.29411.4. The update resolves issues in the application tier related to authentication workflows and database connectivity.
No patches were issued for Azure DevOps Server 2019 in this cycle, as it remains in extended support with servicing ending January 2024. Customers on 2019 should plan migration to a supported version soon.
What the Patches Fix
The updates address multiple security vulnerabilities disclosed through coordinated vulnerability reporting, including elevation of privilege risks in the web portal and remote code execution risks in the build agent communication channel.
Reliability improvements include fixes for intermittent failures in Git large file storage (LFS) operations and incorrect behavior in pull request validation policies under high concurrency.
Performance enhancements target the search indexing service, reducing CPU spikes during large codebase indexing and improving responsiveness in the work item query engine.
How to Apply the Updates
Administrators should download the patch installer from the Visual Studio Downloads page or the Azure DevOps Server download center, ensuring they select the correct version matching their current deployment.
The update process requires stopping the Azure DevOps services, running the installer as an administrator, and following the prompts to apply the database schema changes and binary updates.
After installation, verify the build number in the Azure DevOps Administration Console and confirm all services are running before re-enabling user access to the instance.
Why Timely Patching Matters
Running an unsupported or unpatched version of Azure DevOps Server exposes organizations to known exploits that could compromise source code, build artifacts, or deployment pipelines.
Microsoft’s modern lifecycle policy requires staying within two versions of the current release for mainstream support; applying these patches keeps 2022 and 2020 deployments within the supported window.
Regular patching also ensures compatibility with newer versions of self-hosted agents and extensions, reducing integration friction in hybrid DevOps environments.
Next Steps for Administrators
Review the release notes on the Microsoft Learn page for Azure DevOps Server servicing to understand the full scope of changes and any pre-installation requirements.
Test the patch in a non-production environment first, validating backup/restore procedures and verifying that critical pipelines and repositories function correctly after the update.
Schedule the update during a maintenance window, communicate downtime to stakeholders, and monitor application logs post-update for any anomalies in service startup or database reconnection.
Closing
Applying the September 2023 patches is a straightforward but essential task for maintaining the security and stability of self-hosted Azure DevOps Server instances.
Administrators should prioritize this update as part of their routine infrastructure hygiene, especially if managing environments that handle sensitive code or regulated workloads.
Keep track of future patch releases by subscribing to the Azure DevOps Blog or enabling notifications in the Visual Studio Servicing portal.
What to do next
To stay protected, download the appropriate patch for your Azure DevOps Server version from the official download page, apply it during your next maintenance window, and verify the build number update in the administration console. Make patching a recurring part of your DevOps operational routine.
Source: September Patches for Azure DevOps Server (Azure).
