AZ-400 Question 83
Select 3Your organization has an Azure DevOps project that uses Azure Repos with a 'main' branch. You need to ensure that only the DevOps Leads (Project Administrators) can push directly to the 'main' branch, while the Developer group can create and push feature branches but must submit pull requests for 'main.' Additionally, the Intern group should only be allowed to read the repository. Which of the following configurations should you implement?
- A
- For the Project Administrators group on the 'main' branch, set 'Contribute' to 'Allow' and optionally enable 'Bypass branch policies' if immediate merges are required.
- B
- For the Developer group at the repository level, set 'Contribute' to 'Deny' so that they cannot push new feature branches.
- C
- For the Developer group, set 'Contribute' to 'Allow' at the repository level, but set 'Contribute' to 'Deny' specifically on the 'main' branch.
- D
- For the Intern group, set 'Read' to 'Allow' at the repository level, and set 'Contribute' to 'Deny'.
Show answer and explanation
Correct answers: A, C, D
Explanation
By configuring branch-level and repository-level permissions in Azure DevOps, you can enforce different privileges on the 'main' branch without restricting general development activities. Project Administrators need 'Contribute' (and possibly 'Bypass branch policies') to push directly, Developers require the ability to push feature branches but not to 'main,' and Interns must be limited to read-only access. These are based on Microsoft� recommended best practices for Azure Repos, as detailed in the official Azure DevOps documentation on repository and branch permissions.
- A. Correct.
Option 1 is correct. Allowing the Project Administrators group to 'Contribute' on the 'main' branch ensures they can push directly. Granting the optional 'Bypass branch policies' permission (if needed) lets them merge changes in emergencies without pull request approvals. This matches the requirement that only DevOps Leads can push directly to 'main.'
- B. Incorrect.
Option 2 is incorrect. Denying 'Contribute' at the repository level for the Developer group would prevent them from creating or pushing feature branches, which contradicts the requirement that Developers can create and push their own feature branches (subject to pull requests for merging to 'main').
- C. Correct.
Option 3 is correct. Allowing 'Contribute' at the repository level lets Developers push feature branches. Denying 'Contribute' specifically on the 'main' branch forces them to submit pull requests for merging changes into 'main.', which meets the requirement of preventing direct pushes to 'main.'
- D. Correct.
Option 4 is correct. Interns should only view the code, so 'Read' permission is set to 'Allow,' and 'Contribute' is set to 'Deny,' ensuring they cannot push or modify any branch.