Windows VPS for CI/CD: Setting Up Azure DevOps and GitHub Actions Build Agents

Continuous Integration and Continuous Deployment (CI/CD) pipelines that target Windows environments — .NET applications, SQL Server databases, or desktop applications — require Windows-based build agents to compile, test, and package the code. Instead of using Microsoft-hosted agents (which incur per-minute costs and have limited customization), many teams deploy their own Windows VPS as a self-hosted build agent. This guide covers setting up Azure DevOps and GitHub Actions build agents on a Windows VPS, including security considerations, scalability, and cost optimization.

Why Use a Self-Hosted Windows VPS for CI/CD?

Before diving into setup, consider the advantages of running your own build agent on a Windows VPS:

• Cost savings at scale — Microsoft-hosted agents cost $0.04-$0.08 per minute for Windows. A team running 500 build minutes/day would pay $600-$1,200/month. A Windows VPS for the same workload costs $20-$50/month with no per-minute fees.
• Full software control — Install any SDK, toolchain, certificate, or dependency without waiting for Microsoft to update their agent images. Need .NET 10 preview or a specific Visual Studio version? Install it immediately.
• Persistent storage — Cache NuGet packages, npm modules, and build artifacts between runs. This dramatically speeds up subsequent builds (often 50-70% faster).
• Compliance and data sovereignty — Source code and build artifacts never leave your VPS. This is critical for regulated industries that cannot upload proprietary code to shared Microsoft-hosted infrastructure.
• Custom hardware — Choose a VPS with the exact CPU, RAM, and storage your builds require. For large monorepos or complex builds, 8+ vCPU and 16+ GB RAM can cut build times by 75% compared to standard hosted agents.

Need a Windows VPS for your build infrastructure? Compare Windows VPS plans on our comparison table to find a provider with the CPU and RAM your pipelines need.

Setting Up an Azure DevOps Self-Hosted Agent

Prerequisites

• A Windows VPS (Windows Server 2022 or 2025 recommended) with at least 4 GB RAM and 2 vCPU
• RDP or PowerShell Remoting access
• An Azure DevOps organization and project
• A Personal Access Token (PAT) with Agent Pools (read, manage) scope

Step 1: Install Required Software

On your Windows VPS, install the development tools your pipelines need. At minimum, most .NET pipelines require:

# Install .NET SDK (adjust version as needed)
winget install Microsoft.DotNet.SDK.10

# Install Git
winget install Git.Git

# Install NuGet CLI
winget install Microsoft.NuGet

# For legacy .NET Framework builds, install Visual Studio Build Tools
# Download from: https://visualstudio.microsoft.com/downloads/#build-tools-for-visual-studio-2022

Step 2: Download and Configure the Agent

Create a dedicated directory for the agent (avoid spaces in the path) and download the agent package:

# Create agent directory
mkdir C:gentsuild-agent-01
cd C:gentsuild-agent-01

# Download latest agent (check https://github.com/Microsoft/azure-pipelines-agent for latest version)
Invoke-WebRequest -Uri "https://vstsagentpackage.azureedge.net/agent/4.248.0/vsts-agent-win-x64-4.248.0.zip" -OutFile agent.zip
Expand-Archive -Path agent.zip -DestinationPath .

# Configure the agent
.\config.cmd --unattended --url https://dev.azure.com/your-organization --auth pat --token YOUR_PAT --pool "Default" --agent "win-vps-agent-01" --runAsService --windowsLogonAccount "NT AUTHORITY\SYSTEM"

Step 3: Verify and Test

After configuration, the agent runs as a Windows service. Verify it appears online in Azure DevOps > Project Settings > Agent Pools > Default > Agents. Run a test pipeline to confirm builds execute correctly on your self-hosted agent.

Setting Up a GitHub Actions Self-Hosted Runner

Prerequisites

• A Windows VPS (Windows Server 2022 or 2025) with at least 4 GB RAM and 2 vCPU
• A GitHub account with admin access to the target repository or organization
• A GitHub Personal Access Token (classic, with repo scope) or a GitHub App installation token

Step 1: Download and Configure the Runner

GitHub Actions runners use the same agent technology as Azure DevOps. On your Windows VPS:

# Create runner directory
mkdir C:ctions-runners\my-runner
cd C:ctions-runners\my-runner

# Download the latest runner (check https://github.com/actions/runner/releases for latest)
Invoke-WebRequest -Uri "https://github.com/actions/runner/releases/download/v2.322.0/actions-runner-win-x64-2.322.0.zip" -OutFile runner.zip
Expand-Archive -Path runner.zip -DestinationPath .

# Configure the runner (use the token from GitHub > Settings > Actions > Runners)
.\config.cmd --url https://github.com/your-organization/your-repo --token YOUR_REGISTRATION_TOKEN --name "win-vps-runner-01" --labels "windows,.net,sql" --runasservice

Step 2: Start the Runner Service

# Install and start the service
.\svc.cmd install
.\svc.cmd start

# Verify status
.\svc.cmd status

Once running, the runner appears as “Online” in GitHub > Repository > Settings > Actions > Runners. You can reference it in workflow files using the labels you configured:

jobs:
  build:
    runs-on: [self-hosted, windows, .net, sql]
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: dotnet build -c Release

Security Best Practices for Self-Hosted Agents

Self-hosted build agents run arbitrary code from your pipelines. Follow these practices to keep them secure:

• Dedicated VPS for builds only — Do not run web servers or other services on the same VPS. A compromised build pipeline could expose those services. Use a separate Windows VPS exclusively for CI/CD.
• Least-privilege service account — Run the agent as a dedicated local account (not Administrator) with minimal permissions. The agent service account needs only write access to the build workspace directory.
• Ephemeral agents for untrusted code — If your pipelines run code from forked repositories or external contributors, use ephemeral (container-based or VM-based) agents that are destroyed after each job, not persistent VPS agents.
• Network isolation — Place the build VPS on a separate virtual network or subnet with restricted outbound access. Build agents typically only need outbound HTTPS access to your VCS provider and NuGet/npm registries.
• Regular patching — Keep the Windows VPS fully patched. Build agents need the same security updates as any production server. Configure automatic Windows Update during off-hours.
• Secret management — Use Azure DevOps Variable Groups or GitHub Actions Secrets instead of hardcoding credentials in pipeline YAML. The agent service account should not have access to secret files on disk.

Scaling Self-Hosted Build Agents

As your team grows, you may need multiple build agents. Options for scaling include:

• Multiple agents on one VPS — Install multiple agent instances in separate directories, each configured with a unique name. A VPS with 8 vCPU and 16 GB RAM can comfortably run 4-6 build agents simultaneously, as long as individual builds are not CPU-bound.
• Multiple VPS instances — Provision separate Windows VPS instances for different teams or project groups. This isolates workloads and prevents a single heavy build from starving other teams.
• Auto-scaling with Azure VM Scale Sets — Azure DevOps supports elastic agent pools that automatically provision and deprovision VMs based on pipeline demand. This is the most cost-effective approach for variable workloads.

Cost Analysis: Self-Hosted vs. Microsoft-Hosted Agents

Metric	Microsoft-Hosted (Standard)	Self-Hosted Windows VPS
Per-minute cost	$0.04/min (Windows)	$0 (flat monthly)
Monthly cost (500 min/day)	$600	$20-$50
vCPU	2 (shared)	2-8 (dedicated)
RAM	7 GB	4-32 GB
Software customization	Limited to pre-installed images	Full control
Build cache persistence	No (fresh VM each run)	Yes (persistent disk)
Maintenance responsibility	Microsoft	You

For teams running more than 500 build minutes per month, self-hosted agents on a Windows VPS are typically 80-90% cheaper than Microsoft-hosted agents, with the added benefit of faster builds thanks to persistent caches and dedicated CPU resources.

Conclusion

Setting up a self-hosted CI/CD build agent on a Windows VPS is a straightforward process that yields significant cost savings and performance benefits for teams running Windows-targeted pipelines. Whether you use Azure DevOps or GitHub Actions, the configuration follows the same pattern: prepare your VPS with the required SDKs, download the agent software, configure authentication, and register it with your project. With persistent caches, dedicated hardware, and full software control, a self-hosted Windows VPS agent can cut build times by 50-75% while reducing CI/CD costs by 80% or more compared to Microsoft-hosted alternatives. Compare Windows VPS plans on our comparison table to find a provider with the dedicated CPU and RAM your build pipelines require.