AZ-400 Resource Provider Registration Practice Question
Your Azure DevOps pipeline deploys an ARM template to create a storage account. The deployment fails with 'AuthorizationFailed' error. The service principal used by the service connection has 'Contributor' role on the resource group. What is the most likely issue?
⚠ Common exam trap
Candidates often confuse resource provider registration with RBAC permissions. Even with Contributor on the resource group, if the resource provider is not registered, the deployment can fail because the principal cannot register it at the subscription level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'Microsoft.Storage' resource provider is not registered for the subscription, and the service principal lacks permission to register it at subscription scope.
The AuthorizationFailed error is likely due to the Microsoft.Storage resource provider not being registered for the subscription. The service principal has Contributor on the resource group, but registering a resource provider requires Microsoft.Register/action at the subscription scope, which the principal does not have. The service principal itself is not registered for the resource provider; resource providers are registered at the subscription level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'Microsoft.Storage' resource provider is not registered for the subscription, and the service principal lacks permission to register it at subscription scope.
Why this is correct
Correct. If the Microsoft.Storage resource provider is not registered for the subscription, the deployment fails with an authorization error because the service principal cannot register it (requires subscription-level permissions).
- ✗
The storage account name is already taken.
Why it's wrong here
Incorrect. A storage account name conflict would result in a 'Conflict' or 'AlreadyExists' error, not 'AuthorizationFailed'.
- ✗
The ARM template is using an unsupported API version.
Why it's wrong here
Incorrect. An unsupported API version would produce an error about the API version, not an authorization failure.
- ✗
The service principal does not have 'Contributor' role at the subscription scope.
Why it's wrong here
Incorrect. The service principal has 'Contributor' on the resource group, which is sufficient to deploy a storage account to that resource group. Subscription-level permissions are not required for the deployment itself, only for registering resource providers.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Pipeline
A pipeline is an automated series of steps that takes code from development to production, ensuring quality and speed.
Key term
Service principal
A service principal is an identity created for an application or automated tool to access cloud resources securely without using a human user account.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.