AZ-400 Configure processes and communications Practice Question
Your Azure DevOps pipeline uses a YAML template that includes a step to push a Docker image to Azure Container Registry. The pipeline fails with 'unauthorized: authentication required'. The service connection uses a workload identity federation. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently confuse authentication (identity validation) with authorization (permission to act), assuming any valid identity can push to ACR, but ACR requires explicit role assignment even for federated identities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service principal used by the workload identity does not have the 'acrPush' role
The error 'unauthorized: authentication required' indicates that the Docker client could not authenticate with Azure Container Registry. With workload identity federation, the service principal used by the federated credential must have the 'acrPush' role assigned on the ACR scope to push images. Without this role assignment, the authentication token lacks the necessary permissions, even if the identity itself is valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Docker image tag contains invalid characters
Why it's wrong here
An invalid Docker tag (e.g., containing spaces or special characters like colons) would cause a Docker build or push validation error, such as 'invalid reference format' or 'tag is invalid', before any authentication or authorization attempt is made. It would not manifest as a failure due to missing permissions on the Azure Container Registry.
- ✗
The Azure Container Registry name is incorrect
Why it's wrong here
If the Azure Container Registry name were incorrect, the docker push would fail with a DNS resolution or 'repository not found' error rather than an RBAC authorization failure, because the client would attempt to reach a non-existent registry endpoint. The pipeline would never get far enough to be denied the acrPush role.
- ✓
The service principal used by the workload identity does not have the 'acrPush' role
Why this is correct
The federated identity credential for the workload identity federation is functioning correctly in the authentication phase, but the associated service principal lacks the 'AcrPush' role assignment on the Azure Container Registry, which is required for pushing Docker images. Without this role, the registry rejects the push with an authorization error (e.g., 'unauthorized: authentication required' or 'insufficient permissions'), even though the service principal authenticated successfully.
- ✗
The service connection secret has expired
Why it's wrong here
In workload identity federation, there is no static service connection secret; instead, the pipeline requests a short-lived federated token from Azure AD using the federated credential. An 'expired secret' concept applies only to service principal authentication with a shared secret, so if a secret were truly expired the authentication itself would fail with a credential error rather than an RBAC permission denied, and the likely root cause is the missing acrPush role.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Service connection
A service connection in Azure DevOps is a secure, configurable link that allows your pipelines to authenticate and interact with external services like Azure, GitHub, or on-premises servers.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.