Why a Correctly Permissioned Service Principal Still Gets Key Vault Access Denied
Your organization uses Azure DevOps and Azure Key Vault to manage secrets. You have a pipeline that deploys a web app to Azure App Service. The pipeline uses a variable group linked to Key Vault to retrieve the database connection string. Recently, the build started failing with the error: 'Access to Key Vault is denied. Please ensure the service connection has Get and List permissions on secrets.' The service connection uses a service principal. You have verified that the service principal has the correct Key Vault access policy with Get and List permissions. What is the most likely cause of the failure?
Quick Answer
The service principal isn't the identity actually making the Key Vault call — a variable group linked to Key Vault resolves through the pipeline's build service identity instead. Even with the service principal's access policy configured correctly, if that separate build service identity lacks Get and List permissions on the vault, resolution fails with exactly this error.
⚠ Common exam trap
A common mix-up: candidates assume the service principal configured in the service connection is the identity used to access Key Vault, but in reality, Azure DevOps uses the build service identity for variable group secret retrieval, leading to a permissions mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The build service identity does not have Get and List permissions on the Key Vault secrets.
The error message indicates that the identity attempting to access Key Vault lacks the required permissions. Even though the service principal has the correct access policy, the pipeline may be using a different identity—the build service identity—to authenticate with Key Vault. In Azure DevOps, when a variable group is linked to Key Vault, the pipeline's build service identity (not the service connection's service principal) must have Get and List permissions on the Key Vault secrets. This is a common misconfiguration where the service principal is granted permissions but the build service identity is not.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The service connection is configured to use the wrong Azure subscription.
Why it's wrong here
The subscription is used for targeting Azure resources, not for Key Vault access.
- ✗
The secret name in the variable group does not match the secret name in Key Vault.
Why it's wrong here
A mismatch would cause 'secret not found', not 'access denied'.
- ✗
The service principal used by the service connection does not have Contributor role on the Key Vault.
Why it's wrong here
Key Vault uses access policies, not Azure RBAC (unless configured), and the error is about secrets, not the vault itself.
- ✓
The build service identity does not have Get and List permissions on the Key Vault secrets.
Why this is correct
The build service identity (project collection or project level) must be granted access to Key Vault for variable group resolution.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Service connection
A service connection in Azure DevOps is a secure, configurable link that allows your pipelines to authenticate and interact with external services like Azure, GitHub, or on-premises servers.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are a DevOps engineer at a healthcare company that must comply with HIPAA. The company uses Azure DevOps with YAML pipelines to deploy a multi-tier application to Azure Kubernetes Service (AKS). The application stores sensitive patient data. The security team requires that all secrets (e.g., database passwords, API keys) must be stored in Azure Key Vault and never hardcoded in the pipeline. The pipeline currently uses a service principal (SP1) for AKS deployments. The pipeline has a variable group 'VG-Prod' linked to Key Vault 'KV-Prod' with secrets: 'DbPassword', 'ApiKey'. The pipeline runs successfully in non-production environments. However, when you run the pipeline for production, it fails at the stage that deploys to AKS with the error: 'Error: failed to get secret 'DbPassword' from Key Vault: Forbidden'. You have verified that the secret exists and the variable group is correctly linked. The service principal SP1 has the 'Get' and 'List' permissions on KV-Prod secrets. The AKS cluster is in a different subscription than the Key Vault. What is the most likely cause and how should you fix it?
hard- A.The variable group VG-Prod is not properly linked to KV-Prod; re-link it.
- ✓ B.The service principal used by the Azure Resource Manager service connection that links the variable group to Key Vault does not have 'Get' and 'List' permissions on KV-Prod; add it to the Key Vault access policy.
- C.The secret 'DbPassword' does not exist in KV-Prod; create it.
- D.The service principal SP1 does not have 'Get' and 'List' permissions on KV-Prod; add them.
Why B: The pipeline fails because the service principal used by the Azure DevOps service connection that links the variable group to Key Vault (not SP1, which is used for AKS deployments) does not have 'Get' and 'List' permissions on KV-Prod. When a variable group is linked to a Key Vault, Azure Pipelines fetches secrets using the Azure Resource Manager service connection configured for that variable group. That service principal must be explicitly granted Get and List permissions in the Key Vault access policy. SP1's permissions are irrelevant because it is not the identity used for secret retrieval.
Variation 2. You are designing a release pipeline that deploys a web app to Azure App Service. You need to ensure that configuration secrets (e.g., database connection strings) are not stored in the pipeline YAML file. Which approach should you use?
easy- A.Define the secrets as agent-scoped variables in the release pipeline.
- B.Hardcode the secrets in the App Service configuration and reference them in the pipeline.
- ✓ C.Use an Azure Key Vault variable group linked to the pipeline.
- D.Store the secrets as pipeline variables and mark them as 'Secret'.
Why C: Azure Key Vault variable groups allow you to securely reference secrets stored in Azure Key Vault from within a pipeline without exposing them in the YAML file. The pipeline retrieves the secrets at runtime via a linked service connection, ensuring they never appear in source control or pipeline logs.
Variation 3. Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)
medium- ✓ A.Restrict access using Key Vault access policies
- ✓ B.Use managed identities to authenticate applications
- C.Enable HTTP access for performance
- D.Disable audit logging to reduce exposure
- E.Enable soft-delete to recover deleted secrets
Why A: Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Azure AD for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.
Variation 4. Your organization uses Azure Pipelines for CI/CD. The current pipeline for a .NET Core application builds and runs unit tests, then deploys to a staging environment. The team wants to add a step to run integration tests against the staging environment after deployment, and only if integration tests pass, promote the build to production. The integration tests require a database connection string that is stored as a secret in Azure Key Vault. The pipeline uses a service principal with permissions to read secrets from the Key Vault. You need to modify the pipeline to meet these requirements while ensuring security best practices. Which action should you take?
easy- A.Set the connection string as a secret variable in the pipeline UI and reference it in the integration test step.
- ✓ B.Add an Azure Key Vault task before the integration test step to retrieve the secret and map it to a variable.
- ✓ C.Add a variable group linked to the Key Vault and reference the secret variable directly in the integration test step.
- D.Use a PowerShell script to read the secret from Key Vault using the service principal.
Why B: Both B and C are correct methods for retrieving secrets from Azure Key Vault in a pipeline. Option B uses the dedicated Azure Key Vault task to fetch the secret at the point needed. Option C links a variable group to Key Vault, making the secret available as a variable. Both avoid hard-coding secrets and use the existing service principal. Option C is not invalid; it is a standard pattern. The question should accept both answers or be reworded to require a specific timing that only B satisfies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.