AZ-400 Question 226
Select 2Your team uses Azure DevOps pipelines to build and deploy applications from a private GitHub repository. Currently, you rely on a single developer� personal access token (PAT) that expires every 90 days. This causes pipeline failures when the token expires or if that developer leaves the company. You have been asked to implement a more robust approach by creating a service connection for GitHub using a PAT that doesn�t depend on a single user� credentials. Which two actions should you take to set up this new service connection correctly in Azure DevOps?
- A
Enable 'Allow scripts to access the OAuth token' in the pipeline� agent job settings.
- B
Create a new GitHub service connection in Azure DevOps, providing an organization-owned PAT with the necessary repo permissions.
- C
Store the personal access token in Azure Key Vault as an encrypted secret, then manually update the pipeline variables to use it.
- D
Select the 'Grant access permission to all pipelines' option during the service connection creation if multiple pipelines require this connection.
- E
Add the new PAT under your personal Azure DevOps security settings with full read/write scopes to all organizations.
Show answer and explanation
Correct answers: B, D
Explanation
When setting up a robust, long-term authentication for GitHub in Azure DevOps, the recommended approach is to create a service connection that uses an organization-level or service account PAT with minimal required scopes for security. Selecting the 'Grant access permission to all pipelines' option allows multiple pipelines to share the same connection without depending on a single developer� credentials. For more details, refer to Microsoft documentation on configuring GitHub service connections in Azure DevOps: https://docs.microsoft.com/azure/devops/pipelines/repos/github.
- A. Incorrect.
Option 1: Incorrect. While enabling 'Allow scripts to access the OAuth token' can be useful for certain pipeline tasks, it doesn�t address the core issue of using a single user� expiring PAT. This setting just exposes the default built-in token to scripts within a single pipeline run.
- B. Correct.
Option 2: Correct. Creating a new GitHub service connection with an organization-owned or dedicated machine-user PAT (with repo access) ensures the pipeline doesn�t rely on an individual� personal token and reduces future disruptions caused by user-related token expiration.
- C. Incorrect.
Option 3: Incorrect. Although storing secrets in Azure Key Vault is a secure practice, it doesn�t replace the recommended approach of setting up a dedicated service connection in Azure DevOps. You would still need to manage rotation and references to the Key Vault secret outside the standard service connection framework.
- D. Correct.
Option 4: Correct. If multiple pipelines need this connection, choosing 'Grant access permission to all pipelines' helps centralize authentication. This way, each pipeline can use the same connection without relying on individual user tokens.
- E. Incorrect.
Option 5: Incorrect. Adding the PAT under a personal Azure DevOps profile still ties the token to a single user account. This approach doesn�t solve the problem of pipeline failures when that user account changes or their token expires, and it� not the recommended best practice for shared pipelines.