AZ-400 Question 222
Select 2You manage an Azure DevOps pipeline that deploys a web application to Azure App Service across multiple environments. The application relies on secrets stored in Azure Key Vault. The pipeline runs on Microsoft-hosted agents and must also retrieve secrets during the build and release stages. You want to minimize credential management overhead and follow best practices for secure authentication. Which two approaches should you implement? (Choose two.)
- A
Use a user-assigned managed identity for the Azure DevOps pipeline.
- B
Use a system-assigned managed identity for the Azure DevOps pipeline.
- C
Use a system-assigned managed identity for the Azure App Service.
- D
Use a service principal for the Azure DevOps pipeline.
- E
Store Key Vault credentials in the repository and reference them during pipeline execution.
- F
Use a user-assigned managed identity for the Azure App Service.
Show answer and explanation
Correct answers: C, D
Explanation
In scenarios where you need to grant an Azure DevOps pipeline the ability to deploy and configure resources, the standard best practice is to use a service principal. Managed identities (system-assigned or user-assigned) are designed for Azure resources, not for external services like Azure DevOps pipelines. For the running web application, a system-assigned managed identity is often recommended for simplicity�Azure takes care of identity creation and lifecycle management automatically, which helps reduce ongoing administrative overhead. For more information, see Microsoft's documentation on Service Principals (https://learn.microsoft.com/azure/devops/pipelines/library/service-endpoints) and Managed Identities (https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview).
- A. Incorrect.
Option 1: Incorrect. Azure DevOps pipelines (especially on Microsoft-hosted agents) cannot natively run under a user-assigned managed identity. User-assigned identities are intended for Azure VMs, App Services, and other Azure resources, not Azure DevOps pipelines.
- B. Incorrect.
Option 2: Incorrect. There is no direct way to assign a system-assigned managed identity to a Microsoft-hosted Azure DevOps pipeline. System-assigned MIs only apply to specific Azure resources (e.g., App Service, VM).
- C. Correct.
Option 3: Correct. An Azure App Service can use a system-assigned managed identity to securely retrieve secrets from Key Vault at runtime. This identity is automatically managed by Azure, reducing overhead.
- D. Correct.
Option 4: Correct. Using a service principal for the Azure DevOps pipeline is the recommended approach to authenticate with Azure services or Key Vault. It allows the pipeline to securely obtain tokens without embedding long-lived credentials.
- E. Incorrect.
Option 5: Incorrect. Storing credentials in code repositories is a security risk. Secrets should not be checked into source control. Using Key Vault with appropriate identity-based authentication is more secure and aligned with best practices.
- F. Incorrect.
Option 6: Incorrect. While a user-assigned identity can also be viable for an App Service (especially if you want one identity for multiple resources), it does not reduce overhead compared to a system-assigned identity in this scenario. System-assigned identity is typically simpler to manage when each resource has its own identity.