AZ-400 Question 227
Single answerYou manage an Azure DevOps project that deploys resources into an Azure production subscription. You want to ensure secure, least-privileged authentication for the pipeline. Which approach should you implement?
- A
Use a Personal Access Token (PAT) with full read/write scope for all pipeline tasks.
- B
Create an Azure Resource Manager service connection using a service principal that has only the necessary built-in role.
- C
Store the Azure credentials directly in pipeline variables with secret masking enabled.
- D
Use the default Project Collection Build Service identity and assign the Owner role in the Azure subscription.
Show answer and explanation
Correct answer: B
Explanation
The best practice for deploying Azure resources from an Azure DevOps pipeline is to use a service connection linked to a service principal with the minimal required permissions. This approach is more secure than storing credentials directly in pipeline variables or using broad-scope credentials. Refer to Microsoft Docs (https://docs.microsoft.com/azure/devops/pipelines/library/service-endpoints) for detailed guidance on configuring service connections securely in Azure DevOps.
- A. Incorrect.
Option 1 is incorrect because a broad-scope PAT provides more privileges than necessary and is meant primarily for Azure DevOps interactions (e.g., accessing repositories). It is not the recommended approach for Azure resource deployments, as it can introduce significant security risks.
- B. Correct.
Option 2 is correct. Creating an Azure Resource Manager service connection with a service principal that has only the minimum required built-in role (e.g., Contributor for resource groups, or a custom role with tailored permissions) follows the principle of least privilege. Azure DevOps securely stores these credentials and automatically uses them for pipeline tasks, reducing exposure.
- C. Incorrect.
Option 3 is incorrect because storing credentials directly in pipeline variables, even if they are masked, is less secure and more prone to accidental exposure than using a dedicated service connection. The recommended practice is to use an Azure DevOps service connection specifically designed for secure credential management.
- D. Incorrect.
Option 4 is incorrect because assigning the Owner role to the default build service identity grants excessive privileges. This could lead to security concerns, as the Owner role can manage all aspects of the subscription. Adhering to least privilege is a best practice.