diff --git a/.azure/pipelines/ci.yml b/.azure/pipelines/ci.yml
index 4bd72bd317..acbe5357a3 100644
--- a/.azure/pipelines/ci.yml
+++ b/.azure/pipelines/ci.yml
@@ -65,6 +65,9 @@ variables:
       valule: test
     - name: _PublishArgs
       value: ''
+  # used for post-build phases, internal builds only
+  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
+    - group: DotNet-Winforms-SDLValidation-Params
 
 stages:
 - stage: build