AZ-400 Repository-level permissions Practice Question
A development team uses a forking workflow in Azure Repos. They want to ensure that only specific users can create forks of the main repository. How can they achieve this?
⚠ Common exam trap
The trap is that candidates often confuse repository-level permissions with branch-level settings. They may think 'branch security' controls fork creation because both involve permissions, but fork creation is managed at the repository level, not the branch level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the 'Create Fork' permission from all users except the required group
In Azure Repos, the ability to create forks is controlled by the 'Create Fork' permission, which is a repository-level permission, not a branch-level setting. By default, all contributors have this permission. To restrict fork creation to only specific users, navigate to the repository settings, go to Security (or Permissions), remove the 'Create Fork' permission from all users and groups, then explicitly grant it only to the desired group or individuals. Therefore, the correct answer is D: remove the 'Create Fork' permission from all users except the required group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use branch security to restrict who can create forks
Why it's wrong here
Branch security in Azure Repos controls what users can do with branches that already exist, such as Contribute, Edit Policies, Bypass Policies when completing pull requests, and Force Push. There is no 'Create Fork' permission within branch security settings, and those permissions are scoped to a branch rather than to the repository, so they cannot affect whether someone can create a full copy of the entire repository. Modifying branch security on main or any other branch will therefore not restrict fork creation.
- ✗
Set branch policies on the main branch to prevent forks
Why it's wrong here
Branch policies in Azure Repos are evaluation rules applied to pull requests and direct pushes—such as required reviewers, build validation, and work item linking—and are scoped to a specific branch like main. They do not include any permission that prevents a user from creating a fork, because fork creation is a repository-level security action independent of branch state. Even if you set all available policies on main, any user with the 'Create Fork' permission can still fork the repository without affecting the main branch.
- ✗
Configure the repository to disable forks globally
Why it's wrong here
Disabling forks globally would prevent everyone—including the group that should be allowed to create forks—from forking the repository, which does not satisfy the requirement. Azure DevOps does not expose a repository-level 'disable forks' toggle; the actual enforcement is done through the 'Create Fork' permission at the repository level. A global disable would block the required group too, and it also fails to map to a real configurable control in the forking workflow, unlike granular permission management.
- ✓
Remove the 'Create Fork' permission from all users except the required group
Why this is correct
The 'Create Fork' permission is a repository-level security permission in Azure Repos, stored separately from branch permissions. To allow only a specific group to create forks, you remove the 'Create Fork' permission from all other users and groups (for example, Contributors and Readers) in the repository's Security page, then explicitly set it to 'Allow' for the required group. This is the only per-repository mechanism that enforces the requirement precisely, since it leaves fork creation available to the approved group while denying everyone else.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Repository
A repository is a central storage location where software packages, code, or configuration files are kept, managed, and distributed for use by IT systems.
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.