AZ-400 Container with managed identity access. Practice Question
You are designing a pipeline that must run tasks in a container. The container needs access to Azure resources using a managed identity. Which two configurations are required? (Choose two.)
⚠ Common exam trap
Candidates often confuse pipeline-level authentication (service principal connections) with container-level identity assignment, or think that a Docker login or Azure CLI flag can substitute for the explicit identity configuration on the container resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a system-assigned managed identity on the agent VM.
Enabling a system-assigned managed identity on the agent VM allows the container job to use the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens for authenticating to Azure resources without storing credentials. Option D is incorrect because Azure Pipelines container job resource definitions do not have an 'identity' field; the identity is inherited from the agent VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a system-assigned managed identity on the agent VM.
Why this is correct
Enabling a system-assigned managed identity on the agent VM allows the container to use the IMDS endpoint to request tokens for Azure resources without storing credentials.
- ✗
Use the 'docker login' command in the pipeline.
Why it's wrong here
The 'docker login' command is unnecessary because managed identity handles authentication without needing to log in to container registries for Azure resource access.
- ✗
Add a service principal connection to the pipeline.
Why it's wrong here
A service principal connection is not required because the managed identity on the agent VM provides the necessary authentication; using a service principal would defeat the purpose of using a managed identity.
- ✗
Set the 'identity' field in the container resource definition.
Why it's wrong here
There is no 'identity' field in the container resource definition in Azure Pipelines YAML. The identity is assigned to the container job via the agent VM's managed identity and the IMDS endpoint.
- ✗
Use the Azure CLI task with '–identity' flag.
Why it's wrong here
The Azure CLI task with the '--identity' flag is used for authenticating Azure CLI commands with a managed identity, but this is not a configuration for the container job itself; the identity must be enabled on the agent VM.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-400 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a system-assigned managed identity on the agent VM.Correct answer▾
Why this is correct
Enabling a system-assigned managed identity on the agent VM allows the container to use the IMDS endpoint to request tokens for Azure resources without storing credentials.
✗Use the 'docker login' command in the pipeline.Wrong answer — click to see why▾
Why this is wrong here
docker login is for authentication to a container registry, not for Azure resources.
✗Add a service principal connection to the pipeline.Wrong answer — click to see why▾
Why this is wrong here
Service principal connection is for non-managed identity authentication; managed identity avoids storing credentials.
✗Use the Azure CLI task with '–identity' flag.Wrong answer — click to see why▾
Why this is wrong here
The Azure CLI task can use managed identity, but the configuration requires the identity to be assigned and the task to run inside the container.
Analysis generated from the official AZ-400blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.