Develop a security and compliance plan →mediumMultiple ChoiceObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

You are using Microsoft Defender for Cloud to secure Azure Pipelines. You need to receive alerts when a pipeline run uses a service principal with excessive permissions. Which feature should you enable?

⚠ Common exam trap

A common mix-up: candidates confuse Azure Policy (which enforces resource compliance) with identity monitoring (which detects permission misuse), leading them to select Option B instead of the correct identity-focused alerting feature.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Microsoft Defender for Cloud's identity and access monitoring.

Microsoft Defender for Cloud's identity and access monitoring continuously assesses the permissions of service principals used in Azure Pipelines and generates alerts when it detects over-privileged or anomalous usage. This feature is specifically designed to identify excessive permissions in real-time, enabling proactive security responses without manual log review or policy enforcement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable Azure DevOps audit logs and review them manually.
Why it's wrong here
Azure DevOps audit logs record events within the organization, but manually reviewing them is a reactive, after-the-fact activity that depends on human attention and cannot provide real-time, automated security alerts. These logs are not integrated with Microsoft Defender for Cloud's identity threat detection engine, so they won't surface the pattern of over-privileged service principal usage alongside other Azure AD signals. In contrast, Defender for Cloud continuously correlates identity and access telemetry and triggers immediate alerts, making manual log review insufficient for proactive security monitoring.
✗
Create an Azure Policy to deny over-privileged service principals.
Why it's wrong here
Azure Policy is a resource governance service that evaluates and enforces compliance rules on Azure resources; it can be used to prevent creation of resources with certain configurations, including conditional restrictions on service principals, but it does not continuously monitor runtime identity behavior or generate security alerts for risky permission usage. Because the requirement is real-time detection of suspicious identity activity, a policy-based deny is an incomplete, preventive control rather than an alerting/detective control that surfaces active threats.
✓
Enable Microsoft Defender for Cloud's identity and access monitoring.
Why this is correct
Enabling Microsoft Defender for Cloud's identity and access monitoring activates continuous analysis of Azure AD identities and service principals, including their sign-in patterns, permissions, and usage anomalies. This feature leverages Microsoft Defender for Identity sensors to detect risky behaviors such as suspicious service principal credential usage and over-permissioned resource access, and it emits real-time security alerts. That gives the team the required detection and response capability for identity-based threats in Azure Pipelines.
✗
Configure Microsoft Entra ID Conditional Access policies.
Why it's wrong here
Microsoft Entra ID Conditional Access policies govern user sign-in and session risks for interactive user access; they do not apply to service principal or workload identity behavior in Azure Pipelines and do not provide security alerts for over-privileged service principals.

Go deeper

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question