From dcdd8bc843214f01da964efc5234ed351ca95e00 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Tue, 6 Oct 2026 11:00:51 -0700
Subject: [PATCH] ci(publishing): replace direct NuGet push with ESRP release

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .azure-pipelines/ci-build.yml | 40 ++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml
index 1db7068c75e..24acc53f4b8 100644
--- a/.azure-pipelines/ci-build.yml
+++ b/.azure-pipelines/ci-build.yml
@@ -12,6 +12,7 @@ pr: none
 
 variables:
   BuildConfiguration: 'release'
+  NuGetOrganizationName: 'microsoftgraph'
 resources:
   repositories:
   - repository: 1ESPipelineTemplates
@@ -301,11 +302,6 @@ extends:
             runOnce:
               deploy:
                 steps:
-                - task: NuGetToolInstaller@1
-                  displayName: 'Use NuGet >=5.2.0'
-                  inputs:
-                    versionSpec: '>=5.2.0'
-                    checkLatest: true
                 - task: PowerShell@2
                   displayName: 'Get Latest Commit SHA from repo'
                   inputs:
@@ -320,14 +316,34 @@ extends:
                     filePath: $(Pipeline.Workspace)\scripts\GetNugetPackageVersion.ps1
                     pwsh: true
                     arguments: '-packageDirPath "$(Pipeline.Workspace)/"'
-                - task: 1ES.PublishNuget@1
-                  displayName: 'Push release to NuGet.org'
+                - task: CopyFiles@2
+                  displayName: 'Stage NuGet packages for ESRP release'
+                  inputs:
+                    SourceFolder: '$(Pipeline.Workspace)'
+                    Contents: |
+                      Microsoft.Graph.*.nupkg
+                      Microsoft.Graph.*.snupkg
+                    TargetFolder: '$(Pipeline.Workspace)\nuget-packages\$(NuGetOrganizationName)'
+                - task: EsrpRelease@14
+                  displayName: 'ESRP Release - NuGet'
                   inputs:
-                    command: push
-                    packageParentPath: '$(Pipeline.Workspace)'
-                    packagesToPush: '$(Pipeline.Workspace)\Microsoft.Graph.*.nupkg'
-                    nuGetFeedType: external
-                    publishFeedCredentials: 'microsoftgraph NuGet connection'
+                    connectedservicename: 'Federated DevX ESRP Managed Identity Connection'
+                    usemanagedidentity: false
+                    keyvaultname: 'akv-prod-eastus'
+                    authcertname: 'ReferenceLibraryPrivateCert'
+                    signcertname: 'ReferencePackagePublisherCertificate'
+                    clientid: '65035b7f-7357-4f29-bf25-c5ee5c3949f8'
+                    intent: 'packagedistribution'
+                    contenttype: 'NuGet'
+                    organizationname: '$(NuGetOrganizationName)'
+                    contentsource: 'Folder'
+                    folderlocation: '$(Pipeline.Workspace)\nuget-packages\$(NuGetOrganizationName)'
+                    waitforreleasecompletion: true
+                    owners: 'christiano@microsoft.com,ramsess@microsoft.com,gavinbarron@microsoft.com,jingjingjia@microsoft.com,peombwa@microsoft.com,treicys@microsoft.com'
+                    approvers: 'christiano@microsoft.com,ramsess@microsoft.com,gavinbarron@microsoft.com,jingjingjia@microsoft.com,peombwa@microsoft.com,treicys@microsoft.com'
+                    serviceendpointurl: 'https://api.esrp.microsoft.com/'
+                    mainpublisher: 'ESRPRELPACMAN'
+                    domaintenantid: 'cdc5aeea-15c5-4db6-b079-fcadd2505dc2'
                 - task: GitHubRelease@1
                   displayName: 'GitHub release (Upload Artifacts)'
                   inputs: