AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Azure DevOps and Microsoft Entra ID. The compliance team needs to ensure that access to Azure DevOps projects is governed by conditional access policies. Which Azure DevOps integration should you use?
⚠ Common exam trap
It's easy for candidates to confuse service hooks or OAuth tokens with identity governance features, not realizing that conditional access requires the resource to be a first-party or registered application in Microsoft Entra ID, not just any authentication method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Link the Azure DevOps organization to the Microsoft Entra ID tenant and configure conditional access policies in Microsoft Entra ID.
To govern access to Azure DevOps projects with conditional access policies, you must link the Azure DevOps organization to the Microsoft Entra ID tenant. This integration makes Azure DevOps a registered application within the tenant, allowing conditional access policies (e.g., MFA, device compliance, location-based access) to be evaluated during authentication. Only then can the compliance team enforce organization-wide access rules via Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Link the Azure DevOps organization to the Microsoft Entra ID tenant and configure conditional access policies in Microsoft Entra ID.
Why this is correct
Linking the Azure DevOps organization to your Microsoft Entra ID tenant is the prerequisite that makes conditional access policies effective for Azure DevOps sign-ins. Once linked, Azure DevOps delegates authentication and authorization to Microsoft Entra ID, so conditional access policies you configure in Microsoft Entra ID — such as MFA, device compliance, or location-based restrictions — are evaluated during the interactive sign-in and token issuance flow. This applies organization-wide and covers all users who authenticate through the linked tenant, enforcing policy before users can access Azure DevOps resources.
- ✗
Configure service hooks to enforce conditional access.
Why it's wrong here
Service hooks in Azure DevOps are event-driven HTTP callbacks that integrate with external services such as Slack or Jenkins; they do not participate in authentication or authorization flows, so they cannot enforce conditional access policies.
- ✗
Assign managed identities to users for conditional access.
Why it's wrong here
Managed identities are Microsoft Entra ID identities designed for Azure resources to authenticate without storing credentials in code; they are not user identities and cannot be assigned to users, and conditional access policies evaluate user sign-in conditions, not managed identity resource authentication.
- ✗
Use OAuth tokens to authenticate users.
Why it's wrong here
OAuth tokens are used to authenticate and authorize API requests, but conditional access is enforced by Microsoft Entra ID at token issuance based on signals like device compliance, location, and risk; merely using OAuth tokens for authentication does not apply those policy checks, so it cannot enforce conditional access.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.