Using NuGetAuthenticate to Authenticate a Feed Without Managing PATs
Your build pipeline uses the 'NuGetCommand@2' task to restore NuGet packages. You want to use packages from an Azure Artifacts feed that requires authentication. How should you configure the pipeline to authenticate with the feed?
Quick Answer
Adding a NuGetAuthenticate@1 task immediately before the NuGetCommand@2 restore step is the supported way to authenticate against an Azure Artifacts feed — it automatically acquires credentials through the built-in Azure Artifacts credential provider using the pipeline's own identity, so there's no personal access token to create, store, or rotate manually.
⚠ Common exam trap
Watch out — candidates often confuse service connections (which are used for external services like GitHub or generic endpoints) with the built-in Azure Artifacts authentication, leading them to select Option B, but Azure Artifacts feeds do not require a service connection because authentication is handled automatically via the pipeline's identity and the 'NuGetAuthenticate@1' task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a 'NuGetAuthenticate@1' task before the NuGet restore task.
The 'NuGetAuthenticate@1' task is the correct way to authenticate with Azure Artifacts feeds in a pipeline because it automatically handles credential acquisition using the built-in Azure Artifacts credential provider. It works without needing to store or manage Personal Access Tokens (PATs) manually, and it integrates seamlessly with the pipeline's identity (e.g., the project collection build service). This task must be placed before the 'NuGetCommand@2' restore task to ensure the credentials are available for package restoration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the Personal Access Token (PAT) in a variable and use it in the NuGet config.
Why it's wrong here
PAT-based authentication is less secure and not integrated.
- ✗
Create an Azure Artifacts service connection and select it in the NuGet task.
Why it's wrong here
Service connection is not directly available for NuGet tasks.
- ✓
Add a 'NuGetAuthenticate@1' task before the NuGet restore task.
Why this is correct
This task authenticates with Azure Artifacts.
- ✗
Install the NuGet credential provider on the agent manually.
Why it's wrong here
Not necessary as NuGetAuthenticate handles it.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Artifacts
Azure Artifacts is a service within Azure DevOps that allows teams to create, host, and share packages like NuGet, npm, Maven, and Python, making software dependencies easier to manage across projects.
Key term
Build pipeline
A build pipeline is an automated sequence of steps that compiles source code into a deployable artifact, running tests and checks along the way.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You have a YAML pipeline that builds a Java project using Maven. The pipeline uses a private artifact feed in Azure Artifacts. You need to authenticate to the feed from the pipeline. Which authentication method should you use?
medium- A.Use the 'PipAuthenticate' task with a pip.conf file.
- B.Use the 'npmAuthenticate' task with a .npmrc file.
- ✓ C.Use the 'MavenAuthenticate' task with a settings.xml file.
- D.Use the 'NuGetAuthenticate' task with a nuget.config file.
Why C: The 'MavenAuthenticate' task is specifically designed to authenticate Maven builds against Azure Artifacts feeds. It injects credentials into a settings.xml file, which Maven uses to resolve dependencies from the private feed. This task handles the OAuth token exchange required for Azure DevOps authentication.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.