AZ-400 Question 221
Single answerYou have an Azure DevOps pipeline that executes on a self-hosted agent running on an Azure VM. The pipeline needs to retrieve secrets from Azure Key Vault. You want to configure authentication from the pipeline to the Key Vault with minimal secret management overhead and the ability to rotate credentials easily. Which approach should you choose?
- A
Use a system-assigned managed identity enabled on the Azure VM running the self-hosted agent
- B
Use a service principal authenticated through client secret stored in Azure DevOps
- C
Use a user-assigned managed identity and assign it to the Azure VM running the self-hosted agent
- D
Use a manually rotated certificate-based service principal and store the certificate in a secure location
Show answer and explanation
Correct answer: C
Explanation
Using a user-assigned managed identity in this scenario allows the self-hosted agent to access Azure Key Vault without manually rotating service principal credentials. The identity is not tied to a specific VM, making it flexible and reducing operational overhead. According to Microsoft documentation, user-assigned managed identities can be bound to an Azure resource while also providing a centrally manageable identity. When you use managed identities for Azure resources, token issuance and rotation are automatically handled by the Azure platform, removing the need to store or rotate secrets. For more details, refer to official Microsoft documentation on managed identities: https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview.
- A. Incorrect.
Option 1: A system-assigned managed identity is tied directly to the lifecycle of the Azure VM. While this could work if the pipeline runs on that VM, it is less flexible if you want to detach or re-use the identity across different VMs or services. A user-assigned identity provides more flexibility in this scenario.
- B. Incorrect.
Option 2: A service principal using a client secret is a valid approach, but it introduces secret management overhead in Azure DevOps (storing the secret securely and rotating it periodically). This goes against the goal of minimizing secret management overhead.
- C. Correct.
Option 3: A user-assigned managed identity can be created once and attached to multiple resources, including the Azure VM that hosts the self-hosted agent. It reduces secret management because the Azure platform handles token retrieval, and credentials are rotated automatically. This best meets the requirements.
- D. Incorrect.
Option 4: A certificate-based service principal does improve security over a secret-based approach, but it still requires manual management and rotation of the certificate. This again adds operational overhead compared to a managed identity.