diff --git a/.gitignore b/.gitignore
index 1a6be2b48e..1b478a8361 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,3 +32,4 @@ tests/bcl-test/SystemCoreXunit*.csproj
 tests/bcl-test/SystemXunit.csproj
 global.json
 .idea
+device-tests-provisioning.csx
diff --git a/tools/devops/Makefile b/tools/devops/Makefile
new file mode 100644
index 0000000000..f0771d7f1c
--- /dev/null
+++ b/tools/devops/Makefile
@@ -0,0 +1,10 @@
+TOP=../..
+include $(TOP)/Make.config
+
+device-tests-provisioning.csx: device-tests-provisioning.csx.in Makefile $(TOP)/Make.config
+	$(Q_GEN) sed \
+		-e 's#@XCODE_VERSION@#$(XCODE_VERSION)#g' \
+		-e 's#@XI_PACKAGE@#$(XI_PACKAGE)#g' \
+		-e 's#@MONO_PACKAGE@#$(MIN_MONO_URL)#g' \
+		-e 's#@VS_PACKAGE@#$(MIN_VISUAL_STUDIO_URL)#g' \
+		$< > $@;
diff --git a/tools/devops/device-tests-common.yml b/tools/devops/device-tests-common.yml
index cda61d579f..1989214096 100644
--- a/tools/devops/device-tests-common.yml
+++ b/tools/devops/device-tests-common.yml
@@ -76,25 +76,15 @@ jobs:
     env:
       LOGIN_KEYCHAIN_PASSWORD: $(OSX_KEYCHAIN_PASS)
 
-  - bash: |
-      set -x
-      set -e
+  - bash: make -C $(System.DefaultWorkingDirectory)/xamarin-macios/tools/devops/ device-tests-provisioning.csx
+    displayName: 'Generate Provisionator csx file'
 
-      EC=0
-
-      ./xamarin-macios/system-dependencies.sh --ignore-all --provision-xcode --provision-xamarin-studio --provision-mono --provision-7z || EC=$?
-      if [ $EC -eq 0 ]; then
-        echo "##vso[task.setvariable variable=ProvisioningStatus]success"
-      else
-        echo "##vso[task.setvariable variable=ProvisioningStatus]failure"
-      fi
-      exit $EC
+  - task: xamops.azdevex.provisionator-task.provisionator@1
     displayName: 'Provision dependencies'
-    timeoutInMinutes: 240
-
-  - bash: ./xamarin-macios/tools/devops/install-xi-pkg.sh
-    displayName: 'Install XI PKG'
-    timeoutInMinutes: 15
+    inputs:
+      provisioning_script: $(System.DefaultWorkingDirectory)/xamarin-macios/tools/devops/device-tests-provisioning.csx
+      provisioning_extra_args: '-vvvv'
+    timeoutInMinutes: 250
 
   - bash: |
       set -x
diff --git a/tools/devops/device-tests-provisioning.csx.in b/tools/devops/device-tests-provisioning.csx.in
new file mode 100644
index 0000000000..46256323b3
--- /dev/null
+++ b/tools/devops/device-tests-provisioning.csx.in
@@ -0,0 +1,22 @@
+#r "_provisionator/provisionator.dll"
+
+using System.IO;
+using System.Linq;
+
+using static Xamarin.Provisioning.ProvisioningScript;
+
+Xcode ("@XCODE_VERSION@").XcodeSelect (allowUntrusted: true);
+
+// provisionator knows how to deal with this items
+Item ("@MONO_PACKAGE@");
+Item ("@VS_PACKAGE@");
+Item ("@XI_PACKAGE@");
+
+BrewPackage ("p7zip");
+
+void BrewPackage (string name)
+{
+	// Assumes brew is already installed. 
+	// All Macs provisioned by Xamarin, VSEng, or DDFUN should have brew by default!
+	Item (name).Action (i => Exec ("brew", "install", i.Name));
+}
diff --git a/tools/devops/device-tests.yml b/tools/devops/device-tests.yml
index 8927294c4b..3f3144c4a8 100644
--- a/tools/devops/device-tests.yml
+++ b/tools/devops/device-tests.yml
@@ -9,6 +9,9 @@ resources:
     ref: refs/heads/device-tests-yaml # should this be on a branch and not on master???
     endpoint: xamarin
 
+variables:
+    - group: xamops-azdev-secrets
+
 jobs:
 - template: device-tests-common.yml # all the smart stuff happens in the template, just needed to set the params
   parameters:
diff --git a/tools/devops/install-xi-pkg.sh b/tools/devops/install-xi-pkg.sh
deleted file mode 100755
index ba826a15f8..0000000000
--- a/tools/devops/install-xi-pkg.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/bin/bash -ex
-
-XI_PKG=$XI_PACKAGE
-
-XI_NAME=$(basename $XI_PKG)
-
-if test -z "$XI_NAME"; then
-   echo "No XI_NAME. XI_PACKAGE: $XI_PACKAGE"
-   exit 1
-fi
-
-RETRIES=10
-while true; do
-   RV=0
-   curl -LO --fail $XI_PKG || RV=$?
-
-   if [[ $RV == 0 ]]; then
-       # Yay, download succeeded
-       break;
-   fi
-
-   # Sometimes this happens:
-   #
-   # [...]
-   # 2017-08-15T07:29:26.7901630Z  59  454M   59  270M    0     0  5919k      0  0:01:18  0:00:46  0:00:32 2462k
-   # 2017-08-15T07:29:26.7923300Z curl: (56) SSLRead() return error -36
-   # 2017-08-15T07:29:26.8258480Z /bin/bash failed with return code: 56
-   #
-   # This is random, and if trying again it works.
-   # So if curl exits with exit code 56, we try again a few times.
-   #
-   if [[ ( $RV == 56 ) && ( $RETRIES > 0 )]]; then
-       echo "A hopefully transient error occurred. Trying again."
-
-       # Wait a little bit before trying again. Wait a little bit longer each time.
-       sleep 0.$(echo "10 - $RETRIES" | bc)
-
-       # Make sure nothing is left to interfere with the next download attempt
-       rm -f $XI_PKG
-
-       # Make sure we don't loop forever if the internet goes down
-       let RETRIES--;
-       continue
-   fi
-
-   # All hope is lost.
-   echo "Failed to download $XI_NAME from $XI_PACKAGE."
-   exit $RV
-done
-
-sudo /usr/sbin/installer -pkg "$XI_NAME"   -target / -verbose -dumplog
-
-# Print versions
-/Library/Frameworks/Xamarin.iOS.framework/Versions/Current/bin/mtouch --version
-/Library/Frameworks/Mono.framework/Versions/Current/bin/mono --version
-cat /Library/Frameworks/Mono.framework/Versions/Current/updateinfo