AZ-400 Practice Question: Design and implement build and release pipelines
You are configuring a release pipeline to deploy to Azure App Service. You want to use the 'Deploy Azure App Service' task. Which authentication method should you use to securely connect Azure DevOps to the Azure subscription?
⚠ Common exam trap
Watch out — candidates often confuse SAS tokens (used for storage-level access) with service principal authentication, or mistakenly think Managed Identity can be directly assigned to a non-Azure-hosted DevOps agent, when in fact service connections require a service principal for secure, automated subscription access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Manager service connection using a service principal.
The 'Deploy Azure App Service' task requires a secure, non-interactive connection between Azure DevOps and Azure. An Azure Resource Manager service connection using a service principal is the recommended and supported method because it uses Azure AD authentication with a client secret or certificate, enabling automated, credential-free deployments without user interaction or token expiry issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure CLI authentication with a user account.
Why it's wrong here
Azure CLI authentication with a user account is unsuitable for automated pipelines because it requires interactive login via 'az login', and user credentials are subject to expiration, MFA challenges, and other security risks, making them non-compliant with unattended CI/CD deployment practices.
- ✓
Azure Resource Manager service connection using a service principal.
Why this is correct
An Azure Resource Manager service connection using a service principal is the recommended secure, automated authentication method for CI/CD pipelines; it uses an app registration with a secret or certificate, enables fine-grained role-based access control, and avoids interactive login requirements.
- ✗
Use a SAS token for the App Service.
Why it's wrong here
SAS tokens are used to grant time-limited, delegated access to Azure Storage resources such as blobs and queues, not to Azure App Service applications; App Service deployments require authentication via service principal, publish profile, or deployment credentials rather than a SAS token.
- ✗
Managed Identity assigned to the Azure DevOps agent.
Why it's wrong here
Managed Identity assigned to the Azure DevOps agent is not directly supported as a service connection for Azure DevOps; Azure DevOps requires explicit service principal credentials for Azure resource access, and managed identities are designed for Azure resources themselves, not for external pipeline agents.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Service principal
A service principal is an identity created for an application or automated tool to access cloud resources securely without using a human user account.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.