Azure DevOps: contain a compromised self-hosted agent before reopening the pool
A production runbook for quarantining a suspicious Azure DevOps self-hosted agent, preserving evidence, bounding exposed identities and validating a clean replacement before the pool receives production jobs again.
Read article