AZ-400 Question 82
Single answerYour team is using an Azure DevOps Git repository. All developers can clone and view the repository, but only a select group should be able to push directly to the main branch. Other developers must submit pull requests (PRs) for their changes to be merged into main. You need to configure the repository permissions to meet these requirements with minimal administrative overhead. What should you do?
- A
Grant the 'Contribute' permission to the select group and set 'Contribute' to 'Deny' for the rest, ensuring they only have 'Read' and 'Create branch' permissions.
- B
Enable the 'Force push (rewrite history, delete branches and tags)' permission for all users, then configure branch policies to restrict merges.
- C
Grant the 'Contribute' permission to everyone, but disable 'Bypass pull request policies' for the developers who must use PRs.
- D
Remove the 'Contribute' permission from all users and rely on branch policies alone to control who can push to main.
Show answer and explanation
Correct answer: A
Explanation
In Azure DevOps, repository permissions and branch policies both play important roles in controlling how code is merged into branches. By granting 'Contribute' permission only to the group needing direct pushes and denying it for others, you make sure unauthorized team members can only use Pull Requests. For more information, see the Azure DevOps documentation on Git repository permissions: https://docs.microsoft.com/azure/devops/repos/git/permissions.
- A. Correct.
Correct: Granting 'Contribute' only to the select group (those allowed to push directly) and denying it for the others ensures that only the allowed developers can push to main. The rest can create branches, make changes, and submit pull requests but cannot push directly to main.
- B. Incorrect.
Incorrect: Enabling 'Force push' for everyone can allow rewriting commits and deleting branches, which is risky and does not fulfill the requirement of restricting direct pushes for some developers.
- C. Incorrect.
Incorrect: If 'Contribute' is granted to everyone, it allows direct pushes. Disabling 'Bypass pull request policies' only prevents skipping policies, but developers would still be able to push changes without a PR if they have 'Contribute'.
- D. Incorrect.
Incorrect: Removing 'Contribute' from all users would prevent any direct push to main, ignoring the requirement that a select group can still push directly.