From d84de170a77923b1b1c33df9e01f4a9109f6a63f Mon Sep 17 00:00:00 2001
From: jeff smith <jes@microsoft.com>
Date: Thu, 3 Sep 2026 14:19:22 -0700
Subject: [PATCH] [feat]: implement network isolation policy fixes

---
 azure-pipelines-bench.yml | 2 +-
 azure-pipelines-cd.yml    | 2 +-
 azure-pipelines-ci.yml    | 8 +++++++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/azure-pipelines-bench.yml b/azure-pipelines-bench.yml
index 5b9b025021e..a819a9b527e 100644
--- a/azure-pipelines-bench.yml
+++ b/azure-pipelines-bench.yml
@@ -37,7 +37,7 @@ extends:
         image: HostedPoolWindowsImage  # Name of the image in your pool. If not specified, first image of the pool is used
         os: windows  # OS of the image. Allowed values: windows, linux, macOS
     settings:
-      networkIsolationPolicy: Permissive
+      networkIsolationPolicy: Permissive,CFSClean
     stages:
     - stage: Stage
       jobs:
diff --git a/azure-pipelines-cd.yml b/azure-pipelines-cd.yml
index 6c8385608c6..4fc698f8b53 100644
--- a/azure-pipelines-cd.yml
+++ b/azure-pipelines-cd.yml
@@ -38,7 +38,7 @@ extends:
         image: HostedPoolWindowsImage  # Name of the image in your pool. If not specified, first image of the pool is used
         os: windows  # OS of the image. Allowed values: windows, linux, macOS
     settings:
-      networkIsolationPolicy: Permissive
+      networkIsolationPolicy: Permissive,CFSClean
     stages:
 
     # ── Stage 1: Lightweight detection (runs every night, ~1-2 min) ──
diff --git a/azure-pipelines-ci.yml b/azure-pipelines-ci.yml
index 382ff8f4cbb..36cccf6c1d8 100644
--- a/azure-pipelines-ci.yml
+++ b/azure-pipelines-ci.yml
@@ -7,6 +7,10 @@ pr:
 # The `resources` specify the location and version of the 1ES PT.
 resources:
   repositories:
+  - repository: fastPipelines
+    type: git
+    name: open-source/FASTPipelineTemplates
+    ref: main
   - repository: 1esPipelines
     type: git
     name: 1ESPipelineTemplates/1ESPipelineTemplates
@@ -29,7 +33,7 @@ extends:
         image: HostedPoolWindowsImage  # Name of the image in your pool. If not specified, first image of the pool is used
         os: windows  # OS of the image. Allowed values: windows, linux, macOS
     settings:
-      networkIsolationPolicy: Permissive
+      networkIsolationPolicy: Permissive,CFSClean
     stages:
     - stage: Stage
       jobs:
@@ -62,6 +66,8 @@ extends:
               path: $(npm_config_cache)
             displayName: "Cache npm"
 
+          - template: FAST.CFS.PipelineTemplate.yml@fastPipelines
+
           - script: |
               npm ci
             displayName: "Install package dependencies"