How do I get the UUID of a build Mac from Azure DevOps?
These steps in the Azure DevOps docs may be helpful: Sign Your Mobile App.

Basically you should be able to generate your p12 and provisioning profile on a mac you control, and then using the "Install an Apple certificate/provisioning profile" tasks you can install the certs onto the mac agent for building.  No UUID should be needed for the agent.  Here's a guide that may be useful (it's targeting iOS, not macOS but the concept is the same).

The way I set this up on a project was to go through Microsoft's AppCenter which had tooling to automatically handle the provisioning profile madness: Deploy Documentation.