In order to execute commands securely and to save cost you can create your own Azure DevOps agents on prem on in any cloud closest to your endpoints. I deploy my Azure DevOps agents using Packer, Ansible and Powershell for windows cases so that the configuration and work is all in code. I usually feed the packer image to a VM scale set so that I can scale up and down my agents depending on workload.