Azure DevOps Multi-Stage YAML Pipeline triggered off Main Branch with access to Secrets & Service Connections

azure-pipelines.yml

trigger:
  branches:
    include:
    - 'main'
pr: none

stages:
  - stage: Build
    jobs:
      - template: templates/build.yml

  - stage: QA
    displayName: 'Quality Assurance'
    jobs:
      - deployment: deploy_qa
        displayName: 'Deploy to QA'
        pool:
          vmImage: 'Ubuntu-16.04'
        variables:
          - group: 'QA Secrets'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureResourceManagerTemplateDeployment@3
                  displayName: 'Deploy Azure Resources'
                  inputs:
                    azureResourceManagerConnection: 'Azure QA'
                    subscriptionId: '<redacted>'
                    resourceGroupName: 'dsr-qa-rg'
                    location: 'East US'
                    csmFile: '$(Pipeline.Workspace)/arm/azuredeploy.json'
                    overrideParameters: '-sqlServerName dsr-qa-sql -sqlDatabaseName dsrqadb -sqlAdministratorLoginUsername $(SQLAdministratorLoginUsername) -sqlAdministratorLoginPassword $(SQLAdministratorLoginPassword) -hostingPlanName "dsr-qa-asp" -webSiteName "dsrqaapp"'

  - stage: Production
    displayName: 'Release to Production'
    jobs:
      - deployment: deploy_production
        displayName: 'Deploy to Production'
        pool:
          vmImage: 'Ubuntu-16.04'
        variables:
          - group: 'PRODUCTION Secrets'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureResourceManagerTemplateDeployment@3
                  displayName: 'Deploy Azure Resources'
                  inputs:
                    azureResourceManagerConnection: 'Azure PRODUCTION'
                    subscriptionId: '<redacted>'
                    resourceGroupName: 'dsr-production-rg'
                    location: 'East US'
                    csmFile: '$(Pipeline.Workspace)/arm/azuredeploy.json'
                    overrideParameters: '-sqlServerName dsr-production-sql -sqlDatabaseName dsrproductiondb -sqlAdministratorLoginUsername $(SQLAdministratorLoginUsername) -sqlAdministratorLoginPassword $(SQLAdministratorLoginPassword) -hostingPlanName "dsr-production-asp" -webSiteName "dsrproductionapp"'