AZ-400 Practice Question: Design and implement build and release pipelines
Which THREE conditions must be met for you to use the 'Approvals' feature in Azure Pipelines to control deployments to a production environment? (Choose three.)
⚠ Common exam trap
It's easy for candidates to assume approvals must be configured in the release pipeline's pre-deployment conditions only, but Azure Pipelines also supports approvals in post-deployment conditions and as environment-level checks in YAML pipelines, making option B a common distractor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The approver must have the 'Approve pipeline permissions' permission for the environment.
The 'Approvals' feature in Azure Pipelines requires an environment to be defined in the pipeline. You must add an approval check to that environment, which can be done in either a classic release pipeline or a YAML pipeline that references the environment as a resource. Additionally, the approver(s) - whether individual users or groups - must have the 'Approve pipeline permissions' permission on that environment. Without an environment resource, the approval check cannot be configured; without the permission, approval requests cannot be validated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The approver must be an individual user, not a group.
Why it's wrong here
Approval checks in Azure Pipelines can be assigned to individual users or to groups, including Azure AD groups and security groups. There is no requirement that the approver be a single user; delegating approvals to a group is common to avoid single points of failure. The real prerequisite is that the approver (whether a user or group) must have the 'Approve pipeline permissions' permission on the environment.
- ✗
The approval must be configured in the release pipeline's pre-deployment conditions.
Why it's wrong here
Approvals are not configured directly in a release pipeline's pre-deployment conditions; they are added as checks on an environment in Azure Pipelines. For classic release pipelines, the approval settings are defined on the environment itself, and while they may appear before deployment, they are not part of the pipeline's pre-deployment condition configuration. The condition may trigger the approval, but the approval check itself is bound to the environment resource.
- ✓
The approver must have the 'Approve pipeline permissions' permission for the environment.
Why this is correct
To successfully approve a deployment to an environment, the designated approver must have the 'Approve pipeline permissions' permission on that environment. This permission is managed through the environment's security settings and is separate from permissions like 'View' or 'Manage'. Without this permission, even if a user is listed as an approver, they will not be able to approve the deployment.
- ✓
The pipeline must be a Release Pipeline or a YAML pipeline that uses the 'environment' resource.
Why this is correct
Approvals and checks are tied to environments, so the pipeline must be either a classic release pipeline that has environments defined, or a YAML pipeline that explicitly uses an 'environment' resource in one or more stages. Only then can the approval check be attached to that environment and be enforced during the deployment process. Pipelines that do not reference an environment resource cannot have environment-based approvals.
- ✓
You must create an environment in Azure Pipelines and add an approval check to it.
Why this is correct
You must first create an environment in Azure Pipelines, either manually or implicitly via a YAML pipeline, and then add an approval check to it through the environment's 'Approvals and checks' settings. This check is what triggers the approval request for designated approvers when a pipeline attempts to deploy to that environment. The approval check applies to any pipeline that uses the environment, so it is a shared control point.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.