Problem

The node-api-release pipeline is failing due to 1ES Network Isolation (Enforce mode) blocking outbound connections:

1. NodeTool@0 step fails for Node 16.x, 18.x — Network Isolation blocks connections to nodejs.org, preventing Node binary downloads.
2. Upgrade npm step fails for Node 20.x, 22.x, 24.x — Network Isolation (CFSClean policy) blocks connections to registry.npmjs.org, preventing npm install -g npm@8.

Root Cause

• The pipeline's Network Isolation policy (Preferred,CFSClean) does not include the NodeTool shared policy, which is required to allow downloads from nodejs.org.
• The CFSClean policy intentionally blocks all public package registries (including registry.npmjs.org) for SFI compliance. The Upgrade npm step (npm install -g npm@8) attempts to download from registry.npmjs.org, which is blocked.

Fix

1. Added NodeTool to the network isolation policy — Allows nodejs.org access so NodeTool@0 can download Node binaries.
2. Removed the Upgrade npm step — because every Node version already ships with a sufficient npm version. The bundled npm is sufficient for npm install and npm publish. No upgrade is needed.

Testing

• Verified that the pipeline runs successfully with the NodeTool policy added and the Upgrade npm step removed.
  https://dev.azure.com/mseng/AzureDevOps/_build/results?buildId=31603530&view=results