diff --git a/.azurepipelines/azure-pipelines-1ES.yml b/.azurepipelines/azure-pipelines-1ES.yml
index f5b9e1552..681b26e40 100644
--- a/.azurepipelines/azure-pipelines-1ES.yml
+++ b/.azurepipelines/azure-pipelines-1ES.yml
@@ -9,6 +9,8 @@ resources:
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
+    settings:
+      networkIsolationPolicy: Permissive,CFSClean
     sdl:
       tsa:
         enabled: true
@@ -62,12 +64,16 @@ extends:
           inputs:
             version: 8.0.x
             installationPath: '$(Agent.ToolsDirectory)/dotnet'
+        - task: NuGetAuthenticate@1
+          displayName: 'Authenticate NuGet feeds'
         - task: DotNetCoreCLI@2
           displayName: 'Build and test'
           inputs:
             command: 'run'
             projects: '$(Build.SourcesDirectory)/targets/targets.csproj'
             arguments: '-- ci -c $(BuildConfiguration)'
+          env:
+            RestoreConfigFile: '$(Build.SourcesDirectory)\.config\NuGet.CFS.config'
         - task: PublishTestResults@2
           inputs:
             testResultsFormat: 'VSTest'
diff --git a/.config/NuGet.CFS.config b/.config/NuGet.CFS.config
new file mode 100644
index 000000000..8ea1154bf
--- /dev/null
+++ b/.config/NuGet.CFS.config
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+    <packageSources>
+        <clear />
+        <add key="OneCRM_PublicPackages" value="https://pkgs.dev.azure.com/dynamicscrm/OneCRM/_packaging/OneCRM_PublicPackages/nuget/v3/index.json" />
+        <add key="local" value="../packages" />
+    </packageSources>
+</configuration>