Two Actions That Enforce Least Privilege Across Azure DevOps
Your organization is implementing a security compliance plan for Azure DevOps. Which TWO actions help enforce the principle of least privilege?
Quick Answer
Restricting who can create new agent pools to a small admin team closes off a real CI/CD attack vector — an unauthorized agent pool can run arbitrary code with pipeline-level access to secrets and resources. Combined with granular Azure DevOps security groups scoped to specific permissions rather than broad roles, this keeps access aligned to what each person's job actually requires.
⚠ Common exam trap
A common mix-up: candidates assume built-in roles are always the safest choice (Option C), but Azure DevOps built-in roles like 'Project Administrators' grant broad permissions that exceed least privilege, whereas custom security groups with minimal permissions are more secure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure DevOps security groups to grant minimal permissions
Azure DevOps security groups allow administrators to assign specific permissions to groups rather than individuals, enabling granular control over who can perform actions like editing work items or managing pipelines. This directly supports the principle of least privilege by ensuring users have only the permissions necessary for their role. Option D is correct because restricting agent pool creation to a small admin team prevents unauthorized users from deploying agents that could execute arbitrary code or access sensitive resources, which is a common attack vector in CI/CD environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow all team members to edit security permissions
Why it's wrong here
This violates least privilege.
- ✓
Use Azure DevOps security groups to grant minimal permissions
Why this is correct
This follows least privilege by granting only necessary permissions.
- ✗
Use built-in roles without customizing
Why it's wrong here
Built-in roles may grant more permissions than needed.
- ✓
Restrict who can create new agent pools to a small admin team
Why this is correct
Limiting administrative roles reduces risk.
- ✗
Grant Project Collection Administrators group to all developers
Why it's wrong here
This grants excessive permissions.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions should a DevOps engineer take to ensure that Azure DevOps pipelines comply with the principle of least privilege for service connections?
hard- ✓ A.Create a service principal with permissions scoped to the minimum required Azure resources.
- B.Use the Project Collection Build Service account for all pipeline runs.
- C.Use Workload identity federation to avoid managing secrets.
- ✓ D.Configure the service connection to be available only to specific pipelines.
- E.Use the same service connection for both build and release pipelines.
Why A: Creating a service principal with permissions scoped to the minimum required Azure resources directly implements the principle of least privilege. By assigning only the necessary roles (e.g., Contributor on a specific resource group) to the service principal used in the service connection, you ensure that the pipeline can only perform actions on those resources, reducing the attack surface. This aligns with Azure RBAC best practices for securing automated deployments.
Variation 2. Your company, Contoso Ltd., is a financial services firm that must comply with PCI DSS. You manage a Azure DevOps organization with over 200 projects. Each project uses a service principal to deploy to Azure using service connections stored in library variable groups. Recently, an auditor flagged that a developer used a service principal with Contributor rights on a production subscription to accidentally delete a storage account. The developer had been granted access to the variable group containing that service principal's credentials. You are tasked with implementing a security and compliance plan to prevent this from recurring. The solution must minimize administrative overhead and follow the principle of least privilege. Current environment: All service principals are created in Azure AD and assigned to variable groups. Developers are granted 'User' access level in Azure DevOps and are members of various teams. You have the ability to create Azure AD groups and custom roles. Which course of action should you take?
hard- A.Remove all variable groups and require developers to use their own Azure AD accounts for deployments, granting them Contributor rights only on non-production environments.
- B.Require all pipeline runs that use production service connections to be approved by a security team via Azure Pipelines approval gates.
- C.Implement Azure DevOps pipeline decorators to inject a security task that checks the service connection's role before each deployment, and fail the pipeline if the role is Contributor or higher.
- ✓ D.Create custom Azure RBAC roles with minimal required permissions for each service principal, restrict service connections to specific pipelines using Azure DevOps security settings (e.g., 'Use' permission), and assign developers only the 'Use' permission to the service connections they need, not the variable groups containing credentials.
Why D: It enforces the principle of least privilege by creating custom Azure RBAC roles with minimal permissions, restricting service connections to specific pipelines via Azure DevOps security settings (e.g., 'Use' permission), and assigning developers only the 'Use' permission to the service connections rather than the variable groups containing credentials. This prevents developers from directly accessing or modifying the service principal credentials, eliminating the risk of accidental or malicious use of high-privilege roles like Contributor.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.