Restricting Merges to Main Until a Production-Like Deploy Succeeds
You have a YAML pipeline that deploys to multiple environments. The pipeline uses environment approvals. You need to ensure that the pipeline waits for manual approval before deploying to the production environment. The production environment is named 'Production'. Which configuration should you add to the deployment job?
⚠ Common exam trap
A common mix-up: candidates assume approvals can be defined directly in the YAML pipeline (like a task or a key), but Azure DevOps requires approvals to be configured on the environment resource in the portal, not in the pipeline code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add 'environment: Production' to the deployment job and configure approvals on the environment in the Azure DevOps portal
Environment approvals in Azure DevOps are configured on the environment resource itself, not in the pipeline YAML. By adding 'environment: Production' to the deployment job, the pipeline references the environment, and the manual approval gate is enforced by the approvals configured on that environment in the Azure DevOps portal. This ensures the pipeline waits for approval before proceeding to the production deployment job.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add 'environment: Production' to the deployment job and configure approvals on the environment in the Azure DevOps portal
Why this is correct
In Azure DevOps, attaching a deployment job to an environment named 'Production' and configuring approvals on that environment in the portal is the correct, native mechanism. The environment acts as a gate that pauses the pipeline before deployment, waiting for the designated approvers to approve or reject the release, with full audit trail and notifications.
- ✗
Add 'approvals: Production' to the deployment job
Why it's wrong here
There is no 'approvals' key defined in the YAML schema for a deployment job. Approvals are not specified inline in pipeline code; they are configured as checks on an environment resource in the Azure DevOps portal or via REST API, not in the pipeline definition, so this option would result in a YAML validation error.
- ✗
Add 'checks: Production' to the deployment job
Why it's wrong here
Similarly, 'checks' is not a valid YAML key to add to a deployment job. Checks, including manual approvals, are added to environments through the Azure DevOps portal, not declared in pipeline YAML. The proper way is to reference an environment and then configure checks on that environment, as this integrates with the environment lifecycle.
- ✗
Add 'dependsOn: ProductionApproval' and use a separate stage for approval
Why it's wrong here
While a separate stage could be used to simulate a gate, 'dependsOn: ProductionApproval' does not create a manual approval step by itself; it only sets a pipeline dependency. This approach would require custom implementation and lacks the built-in environment checks, audit history, and user-friendly approval UI that the native environment approvals provide.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-400 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add 'environment: Production' to the deployment job and configure approvals on the environment in the Azure DevOps portalCorrect answer▾
Why this is correct
In Azure DevOps, attaching a deployment job to an environment named 'Production' and configuring approvals on that environment in the portal is the correct, native mechanism. The environment acts as a gate that pauses the pipeline before deployment, waiting for the designated approvers to approve or reject the release, with full audit trail and notifications.
✗Add 'approvals: Production' to the deployment jobWrong answer — click to see why▾
Why this is wrong here
'approvals' is not a valid keyword in YAML pipeline syntax.
✗Add 'checks: Production' to the deployment jobWrong answer — click to see why▾
Why this is wrong here
'checks' is not a valid keyword; checks are configured on environments.
✗Add 'dependsOn: ProductionApproval' and use a separate stage for approvalWrong answer — click to see why▾
Why this is wrong here
While you can create a separate stage for approval, it's not the standard way; environment approvals are built-in.
Analysis generated from the official AZ-400blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Implementing Deployment Patterns and Strategies
Key term
Approval gate
An approval gate is a checkpoint in an Azure DevOps release pipeline where a pipeline run pauses until a designated team or person manually approves or rejects the deployment.
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
About these practice questions
This AZ-400 question is part of Courseiva's 696-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses Azure Pipelines for CI/CD. You need to ensure that only approved branches can trigger production deployments. Which feature should you use?
easy- A.YAML template expressions
- ✓ B.Branch control for environments
- C.Deployment gates
- D.Pipeline decorators
Why B: Branch control for environments in Azure Pipelines allows you to restrict which branches can trigger deployments to specific environments, such as production. By configuring branch filters on an environment, you ensure that only approved branches (e.g., main or release branches) can initiate a production deployment, providing a security and governance boundary.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.