AZ-400 Question 244
Select 2You are configuring an Azure DevOps pipeline for a new .NET web application that stores its database credentials in Azure Key Vault. The build agent runs on an Azure VM with a system-assigned managed identity. However, your release pipeline fails to retrieve the secrets from the Key Vault and displays an 'Access Denied' error. Which two steps must you configure so that the release pipeline can successfully retrieve the secrets?
- A
Add a Key Vault access policy granting the build agent� managed identity Get and List permissions for secrets.
- B
Grant the build agent� managed identity the Key Vault Contributor role at the subscription level.
- C
Configure the Azure Key Vault task in the pipeline to use a Resource Manager service connection tied to the agent� managed identity.
- D
Create a separate variable group in Azure DevOps and store the Key Vault secrets directly in that group.
Show answer and explanation
Correct answers: A, C
Explanation
In Azure DevOps, a release pipeline must authenticate to Azure Key Vault to retrieve secrets. When you use a system-assigned managed identity, you must grant that identity the required Key Vault permissions (Get and List) and configure the pipeline� Azure Key Vault task to use the appropriate service connection. Refer to Microsoft� documentation on Azure Key Vault with Managed Identities (https://learn.microsoft.com/azure/key-vault/general/overview) and Azure DevOps pipelines (https://learn.microsoft.com/azure/devops/pipelines/tasks/deploy/azure-key-vault) for detailed guidance on access policies, RBAC, and managed identity configurations.
- A. Correct.
Option 1 is correct. By default, Azure Key Vault denies all access. You need to configure either an access policy (if using the traditional model) or RBAC roles (if using RBAC for Key Vault) that grant the specific identity Get and List permissions to read secrets.
- B. Incorrect.
Option 2 is incorrect. While granting a role at the subscription level could eventually let the managed identity configure the Key Vault, this approach is excessively broad and typically not recommended. Minimal privileges should be granted at the Key Vault level.
- C. Correct.
Option 3 is correct. You must explicitly configure your Azure DevOps pipeline's Key Vault task to use a service connection associated with the managed identity that has the necessary permissions. This ensures the pipeline can authenticate securely with Azure Key Vault.
- D. Incorrect.
Option 4 is incorrect. Storing secrets directly in an Azure DevOps variable group does not automatically solve the 'Access Denied' issue with Azure Key Vault. Although variable groups can store secrets, they are not equivalent to configuring the managed identity to retrieve secrets directly from Key Vault.