Match each Azure DevOps security concept to its purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Personal access token for API authentication
Securely stores credentials for external services
Shared variables with optional secret protection
Centralized secure files and variable groups
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Azure Active Directory: Used for identity and access management, including authentication to Azure DevOps.
Azure AD manages user identities; PATs authenticate scripts; Service Principals authenticate automated services; Security Groups manage user permissions. Common confusions include mixing the roles of Azure AD and Service Principals, or PATs with Security Groups.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Azure Active Directory: Used for identity and access management, including authentication to Azure DevOps.
Why this is correct
Azure Active Directory (Azure AD) is the identity provider for Azure DevOps, handling user authentication and enabling conditional access, MFA, and enterprise directory integration. It controls who can sign in and be assigned to organizations, while fine-grained permissions are then granted via security groups.
Personal Access Token (PAT): Used as an authentication token for scripts, tools, or applications that interact with Azure DevOps.
Why this is correct
A Personal Access Token (PAT) is a scoped credential used to authenticate scripts, CLI tools, and REST API calls to Azure DevOps without exposing your password. PATs support explicit expiration dates and permission scopes, making them the standard for automated non-interactive access.
Service Principal: Used to authenticate automated tools or services (e.g., pipelines) to Azure resources.
Why this is correct
A service principal is a non-interactive identity representing an application or service, used in Azure DevOps pipelines (often via workload identity federation or service connections) to authenticate to Azure resources and perform deployments. Unlike a user, it is not tied to a personal account and can be granted Azure RBAC roles.
Security Group: Used to manage permissions for a collection of users in Azure DevOps.
Why this is correct
Security groups in Azure DevOps are collections of users used to assign permissions at the organization, project, or object level, simplifying access management by granting roles to the group rather than each individual. Built-in groups (e.g., Project Administrators, Contributors) are provided, and custom groups can be created or synchronized from Azure AD.
Azure Active Directory: Used to authenticate automated pipelines to Azure resources.
Why it's wrong here
This statement is incorrect because authenticating automated pipelines to Azure resources is the role of a service principal, which represents the non-interactive service identity in Azure AD. Azure AD itself is the identity provider that authenticates users to Azure DevOps, not the credential used by pipelines.
Personal Access Token (PAT): Used to manage permissions for groups of users.
Why it's wrong here
This statement is incorrect: managing permissions for groups of users is the function of security groups in Azure DevOps, which collect users and assign permissions collectively. A PAT is an authentication token for API/CLI access, not a permission management object.
Go deeper
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.