You have an Azure subscription and an Azure DevOps organization. You need to recommend a solution for connecting Azure DevOps pipelines to the resources in the subscription by using Azure Resource…

Question

Options

• Aservice principals and secrets
• Bworkload identity federation and service principals
• Cworkload identity federation and user-assigned managed identities
• Dworkload identity federation and system-assigned managed identities

• A
  4% (2)
• B
  15% (8)
• C
  75% (41)
• D
  7% (4)

Explanation

The correct answer is C: workload identity federation and user-assigned managed identities. Workload identity federation allows Azure DevOps pipelines to authenticate to Azure without storing secrets or certificates, eliminating credential management risk and aligning with least privilege. User-assigned managed identities are preferred over system-assigned (D) because they exist independently of any single resource lifecycle, can be shared across multiple pipelines, and their permissions can be scoped precisely per the least privilege principle. Option A (secrets) and B (service principals with secrets) both require storing and rotating credentials, which Microsoft CAF explicitly discourages in favor of secretless authentication via workload identity federation.

No community discussion yet for this question.