AZ-400 Question 233
Select 3You are setting up an Azure DevOps project with three functional teams: QA, Dev, and Build Management. The QA Team should only view code changes and build results. The Dev Team should be able to check in code and queue builds but not modify build definitions. The Build Management Team needs full control over build definitions but should not administer the entire project. You want to follow best practices by leveraging built-in security groups where possible. Which three configuration changes should you implement?
- A
- Add the QA Team as members of the built-in 'Readers' group and grant no additional permissions.
- B
- Add the Dev Team to the built-in 'Contributors' group and explicitly revoke 'Edit build pipeline' at the pipeline level.
- C
- Add the Build Management Team to the built-in 'Project Administrators' group to enable full control over the entire project.
- D
- Create or use an existing 'Build Administrators' group (or a custom group) for the Build Management Team and allow 'Edit build pipeline' permissions without granting project-wide admin rights.
Show answer and explanation
Correct answers: A, B, D
Explanation
Applying the principle of least privilege in Azure DevOps ensures that teams only have the permissions they require. The QA Team can remain in the 'Readers' group for viewing code and build results. The Dev Team is adequately served by the 'Contributors' group, with 'Edit build pipeline' explicitly revoked. Finally, giving the Build Management Team a dedicated role (like 'Build Administrators'), rather than placing them in 'Project Administrators,' aligns with Microsoft� recommended best practices for restricting project-wide administration to only those who genuinely need it.
- A. Correct.
Option 1: Correct. The QA Team only needs to view code and build results. The 'Readers' group provides the required read-only access without extra privileges.
- B. Correct.
Option 2: Correct. The Dev Team needs to commit code and queue builds. Placing them in the 'Contributors' group grants these capabilities. Explicitly revoking 'Edit build pipeline' ensures they cannot modify or delete build definitions.
- C. Incorrect.
Option 3: Incorrect. The 'Project Administrators' group provides broad administrative rights across the project. This violates the principle of least privilege for the Build Management Team, as they only need control over build pipelines.
- D. Correct.
Option 4: Correct. Assigning the Build Management Team to a 'Build Administrators' group (or a custom group with similar scope) allows them to create and manage build pipelines without granting them all project-level permissions.