Azure Pipelines "extends template" Required by Security Policy
A protected resource (environment, service connection, or repository) has a "Require a template" check. Any pipeline using that resource must extends: an approved governance template, or the run is blocked.
What this error means
The run fails at the protected-resource check with a message that the pipeline must extend a specific template. The YAML is otherwise valid; it is the security policy that rejects it.
##[error]Pipeline must extend template 'templates/secure.yml@governance'
to use service connection 'azure-prod'.Common causes
Required-template check on a protected resource
An admin added a "Require a template" approval/check on the resource. Only pipelines that extend the listed template (from the listed repo/ref) may use it.
Pipeline uses jobs/stages directly instead of extends
A pipeline written with top-level stages:/jobs: does not satisfy the policy. It must restructure to extends: { template: ... } against the governance template.
How to fix it
Extend the approved governance template
Restructure the pipeline to extend the required template and pass parameters.
extends:
template: templates/secure.yml@governance
parameters:
stages:
- stage: Build
jobs: [ { job: b, steps: [ { script: echo build } ] } ]Declare the governance template repository
If the template lives in another repo, declare it as a resource at the listed ref.
resources:
repositories:
- repository: governance
type: git
name: Platform/pipeline-governance
ref: refs/heads/mainHow to prevent it
- Adopt the shared extends template for any pipeline touching protected resources.
- Keep the governance template repo declared and authorized.
- Coordinate with the resource owner on which template/ref the check requires.