PFX certificate, with its private key, of the Azure AD app that reads Key Vault secrets: an absolute path, a path relative to the workspace, or a URL (a SAS token is never logged). It is imported into LocalMachine\My of the container and the service tier is configured with its thumbprint. A new container gets it through C:\Run\my\SetupConfiguration.ps1 at its first start; a reused container is updated in place and its service tier restarts only when a setting changed.
keyvault_pfxpassword
Secret
no
(empty)
Both
Password for the PFX certificate. Store this in a pipeline secret variable.
keyvault_clientid
Text
no
(empty)
Both
Application (client) ID of the Azure AD app that reads Key Vault secrets (AzureKeyVaultClientId). Required when keyvault_pfxfile is set.
keyvault_publisher_validation
Boolean
no
false
Both
Sets AzureKeyVaultAppSecretsPublisherValidationEnabled. When enabled, an extension can only read the key vault when its publisher is listed in the vault's AllowedPublishers secret.
-task:ALOpsDockerStart@3displayName:'ALOpsDockerStart'inputs:fixed_tag:# Fixed container label. When set, the container is tagged with this value instead of the build ID. Enables container reuse across builds. $(fixed_tag)ignore_no_container_warning:True# Suppress the warning when no existing container is found for reuse. $(ignore_no_container_warning)docker_image:# Full Docker image name including tag, for example mcr.microsoft.com/businesscentral:ltsc2022. Leave empty to use the default BC sandbox image. $(docker_image)docker_pull:True# Pull the Docker image before creating the container. Disable to use a locally cached image. $(docker_pull)accept_image_eula:True# Accept the End User License Agreement for the Business Central Docker image. $(accept_image_eula)accept_image_outdated:True# Accept an outdated Docker image without failing the task. $(accept_image_outdated)container_restart:no# Docker restart policy for the container. $(container_restart)memory_gb:-1# Memory limit in GB for the container. Set to -1 for no limit. $(memory_gb)docker_parameters:# Additional parameters passed to docker create. One parameter per line. $(docker_parameters)enable_symbol_loading:False# Enable symbol loading in the Business Central server instance. $(enable_symbol_loading)enable_api_services:False# Enable API services in the Business Central server instance. $(enable_api_services)multitenant:False# Configure the Business Central server instance for multitenancy. $(multitenant)docker_authentication:None# Authentication method for the Docker registry. $(docker_authentication)docker_username:# Username for Docker registry authentication. $(docker_username)docker_password:# Password for Docker registry authentication. Store this in a pipeline secret variable. $(docker_password)docker_registry:# Docker registry URL. When empty, the registry is derived from the image name. $(docker_registry)sql_server:# External SQL Server hostname. Leave empty to use the container's built-in SQL instance. $(sql_server)sql_server_instance:# SQL Server named instance. $(sql_server_instance)sql_database:# SQL database name to use for the Business Central service tier. $(sql_database)sql_database_user:# SQL Server authentication username. $(sql_database_user)sql_database_user_password:# SQL Server authentication password. Store this in a pipeline secret variable. $(sql_database_user_password)sql_backup_file:# Path to a .bak file to restore into the container's SQL instance. $(sql_backup_file)licensefile:# Path to a Business Central license file (.flf or .bclicense) to import into the container. $(licensefile)encryption_key:# Path to an encryption key file to import into the container. $(encryption_key)taskscheduler:Keep# Configure the BC task scheduler. Keep preserves the default, Enable starts it, Disable stops it. $(taskscheduler)keyvault_pfxfile:# PFX certificate, with its private key, of the Azure AD app that reads Key Vault secrets: an absolute path, a path relative to the workspace, or a URL (a SAS token is never logged). It is imported into `LocalMachine\My` of the container and the service tier is configured with its thumbprint. A new container gets it through `C:\Run\my\SetupConfiguration.ps1` at its first start; a reused container is updated in place and its service tier restarts only when a setting changed. $(keyvault_pfxfile)keyvault_pfxpassword:# Password for the PFX certificate. Store this in a pipeline secret variable. $(keyvault_pfxpassword)keyvault_clientid:# Application (client) ID of the Azure AD app that reads Key Vault secrets (`AzureKeyVaultClientId`). Required when `keyvault_pfxfile` is set. $(keyvault_clientid)keyvault_publisher_validation:False# Sets `AzureKeyVaultAppSecretsPublisherValidationEnabled`. When enabled, an extension can only read the key vault when its publisher is listed in the vault's `AllowedPublishers` secret. $(keyvault_publisher_validation)