Using Managed Identity to Authenticate Service Connections to Entra ID
Your organization is adopting Microsoft Entra ID for identity management. You need to configure Azure DevOps to trust tokens issued by Entra ID for service connections. Which authentication method should you use?
Quick Answer
Managed identity is the authentication method built for this: it gives Azure DevOps an automatically managed identity in Microsoft Entra ID with no credentials to store, rotate, or leak, which is exactly why it's the recommended way to authenticate service connections once an organization standardizes on Entra ID for identity management.
⚠ Common exam trap
It's easy for candidates to confuse managed identity with service principal authentication, thinking that a client secret is required for any non-interactive authentication, but managed identity provides a secretless, automatically rotated credential that is specifically designed for Azure-hosted resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed identity
Managed identity (Option B) is correct because it allows Azure DevOps to authenticate to Microsoft Entra ID without storing any credentials, using an identity automatically managed by Azure. This is the recommended approach for service connections when the Azure DevOps agent runs on an Azure resource (e.g., a VM or App Service) that supports managed identities, as it eliminates the need for secret rotation and reduces security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service principal with client secret
Why it's wrong here
A service principal with client secret authenticates the application itself to Microsoft Entra ID, but the question requires Azure DevOps to trust tokens issued by Entra ID for service connections. This method lacks the token-exchange capability needed to validate an externally issued identity token. It is tempting because service principals are the standard way to authorise automated tools in Azure, and they would be correct if the goal were to grant DevOps direct resource access via a stored secret rather than trusting an external token.
- ✓
Managed identity
Why this is correct
Managed identities provide an automatically managed identity in Entra ID for service connections.
- ✗
OAuth 2.0 authorization code grant
Why it's wrong here
This is for user authentication, not service-to-service.
- ✗
Personal access token (PAT)
Why it's wrong here
PATs are not Entra ID tokens and require manual rotation.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Agent
An agent is a software component that runs on a local machine to perform automated tasks, collect data, or execute commands as part of a larger system like CI/CD or monitoring.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Azure DevOps to manage CI/CD pipelines. The security team requires that all pipeline runs use a specific service connection that references a managed identity in Microsoft Entra ID. However, some developers have been using personal access tokens (PATs) in their pipelines, bypassing the managed identity. What should you implement to enforce the use of the managed identity service connection?
medium- A.Configure a branch policy on the main branch to require a specific service connection.
- ✓ B.Use a pipeline decorator to validate the service connection and fail the pipeline if an unauthorized connection is used.
- C.Restrict the use of PATs by setting an agent pool-level permission.
- D.Store the service connection ID in a variable group and reference it in each pipeline.
Why B: Pipeline decorators allow you to inject custom validation steps into every pipeline run at the organization or project level. By using a decorator that checks the service connection ID used in each job and fails the run if it does not match the approved managed identity connection, you can enforce compliance without relying on developer cooperation or manual policy configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.