How can I connect to a third-party public Maven repository in an Azure DevOps Artifact Feed?

Hello Eliezer Ramos,

Azure DevOps does not allow adding custom third-party Maven repositories as upstream sources in the feed UI. Custom upstream source support is limited to npm registries only. For Maven feeds, you can only select predefined public repositories such as Maven Central, Google Maven, and JitPack, but not arbitrary Maven URLs. This is a built-in product limitation.

If you require connecting to other Maven repositories, you must configure them directly in your Maven pom.xml or settings.xml files or use an external artifact proxy solution for caching and management.

Solution: Configure Maven Directly via settings.xml

The most reliable way to access a third-party Maven repository is to configure the repository details directly within your project's build settings. This tells your build agent (or local machine) to check this external URL in addition to your Azure Artifacts Feed.

The best practice is to use the settings.xml file to handle credentials securely and keep repository details separate from your pom.xml.

1. Add Credentials (for Authenticated Repos)

If the third-party repository requires credentials, define them in the <servers> section of your settings.xml.

<settings>
  <servers>
    <server>
      <id>my-third-party-repo-id</id>
      <username>myUsername</username>
      <password>myPasswordOrToken</password>
    </server>
  </servers>
</settings>

2. Define the Repository in a Profile

Use a <profile> to define the repository's URL. Ensure the <id> here matches the <server> ID above for authentication.

<settings>
  <profiles>
    <profile>
      <id>external-maven-sources</id>
      <repositories>
        <repository>
          <id>my-third-party-repo-id</id>
          <name>External Vendor Repository</name>
          <url>https://url-of-repository</url>
          <releases>
            <enabled>true</enabled>
          </releases>
          <snapshots>
            <enabled>false</enabled>
          </snapshots>
        </repository>
      </repositories>
    </profile>
  </profiles>
  
  <activeProfiles>
    <activeProfile>external-maven-sources</activeProfile>
  </activeProfiles>
</settings>

1. Pros: Your build will successfully resolve dependencies from the third-party repository. This is the standard Maven approach for working with external sources.
2. Cons: These external packages will not be cached, proxied, or subject to provenance checks by your Azure Artifacts Feed. The connection is made directly from your Maven client to the external repository.

Documentation:

• Connect to an Azure Artifacts feed - Maven
• Publish Maven packages to an Azure Artifacts feed
• Add Maven Central upstream

I hope this helps you resolve the issue. If you continue to face any challenges or have further questions, feel free to reach out. Thank you!

Hello Eliezer Ramos, following up to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this. Thank you!

Hello Eliezer Ramos, just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this. Thank you!

Quite crazy that Microsoft's answer to this missing feature is 'keep using JFrog Artifactory / Sonatype Nexus'