AZ-400 Configure processes and communications Practice Question
A developer reports that their Azure DevOps pipeline is failing with 'Access denied' when trying to push to a protected branch. The branch policy requires a successful build and approval from the 'Code Owners' group. The developer is a member of 'Contributors' but not 'Code Owners'. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer is not in the 'Code Owners' group allowed to bypass the policy.
The branch policy requires membership in the 'Code Owners' group to push directly to the branch. The developer is not a member, so they get 'Access denied'. Option A (invalid characters) would cause a different error. Option B (pipeline service principal lacking permission) is unrelated to the developer's push. Option C (lacking 'Contribute' permissions at project level) is less specific and would result in a different error; the error here is specifically due to branch policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The branch name contains invalid characters.
Why it's wrong here
Invalid Git branch names (for example, containing spaces, '~', '^', ':', or '..') are rejected by the Git ref validation layer before any Azure DevOps branch policy is evaluated. This would produce a client-side push error such as 'refs/heads/... is not a valid ref name' or an invalid commit ref, not a pipeline permission failure. Since the developer's push was accepted, an invalid-name error cannot be the cause here.
- ✗
The pipeline's service principal lacks 'Create Branch' permission.
Why it's wrong here
Azure DevOps services and pipelines do not need any permission to 'create a branch' when running a standard CI build triggered by a push; the build simply consumes the pushed commit. Branch creation is only relevant for pipeline operations like GitSync or creating pull request branches, none of which apply in this push-trigger scenario. Moreover, the failure is reported on the developer's push, so any service principal permission deficit would be unrelated to the push rejection.
- ✗
The developer lacks 'Contribute' permissions at the project level.
Why it's wrong here
Project-level 'Contribute' permissions are only the broad baseline that governs work item editing and non-version-control areas; Git branch security is evaluated separately and more specifically. Even a contributor with project-level access can be blocked by a configured branch policy that restricts who can push to a protected branch like 'main'. The correct fix is adding the developer to the branch's allowed permissions group, not expanding project-level rights.
- ✓
The developer is not in the 'Code Owners' group allowed to bypass the policy.
Why this is correct
Azure DevOps branch policies provide a checkbox called 'Allow bypassing of branch policy' that can be granted to specific security groups, commonly a 'Code Owners' group. If the developer is not a member of that allowed group, the Git server rejects their push with an error like 'Denied by branch policy'. Because the push never reaches the remote, the CI pipeline never triggers, so the developer sees a failed build—rather than a missing 'Contribute' right or a pipeline service principal issue.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Branch policy
A branch policy is a set of rules and conditions enforced on a Git branch to control how code changes are proposed, reviewed, and merged, ensuring code quality and protecting critical branches.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.