AZ-400 Question 220
Single answerYou are creating an Azure DevOps pipeline that needs to deploy resources to multiple subscriptions and retrieve secrets from Azure Key Vault. The pipeline identity should remain consistent across different subscriptions and resources, and you want to avoid manually rotating credentials. Which identity type should you choose to meet these requirements?
- A
Use a user-assigned managed identity for the pipeline
- B
Use a system-assigned managed identity for the pipeline
- C
Use a service principal with a client secret
- D
Use a service principal with a self-signed certificate
Show answer and explanation
Correct answer: A
Explanation
User-assigned managed identities can be created independently of any specific resource and assigned to one or more Azure resources, making them reusable across multiple subscriptions. Because Azure automatically manages the credentials, there is no need to manually rotate secrets or certificates. This aligns with best practices outlined in the Microsoft documentation: https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview.
- A. Correct.
Correct: A user-assigned managed identity can be created once and reused across multiple Azure resources or subscriptions. It avoids manual rotation of credentials because Azure handles that automatically, while also providing a consistent identity across deployments.
- B. Incorrect.
Incorrect: A system-assigned managed identity is tied to a specific Azure resource (for example, a VM or App Service). It cannot be reused across multiple subscriptions, so it does not fit the requirement for a consistent identity in this scenario.
- C. Incorrect.
Incorrect: A service principal with a client secret does provide an identity, but it introduces the overhead of managing and periodically rotating the client secret. This goes against the requirement to avoid manual credential rotation.
- D. Incorrect.
Incorrect: A service principal with a certificate still requires you to manage credential-storing and rotation of the certificate. Although somewhat more secure than a client secret, it does not eliminate manual overhead for credential management.