Blocking Unverified Third-Party Actions with an Explicit Allow List
Your organization uses GitHub Actions and needs to enforce that only approved actions from the GitHub Marketplace can be used in workflows. Developers have been using custom actions from third-party repositories. What is the most effective way to control which actions are allowed?
Quick Answer
The 'Allow actions created by GitHub and verified partners' policy combined with an explicit allow list gives the most precise control here: it blocks unverified third-party actions by default while still letting you whitelist the specific outside actions your workflows actually need, rather than an all-or-nothing restriction to only Marketplace-verified publishers.
⚠ Common exam trap
Watch out — candidates often choose Option B (disallow all third-party actions) thinking it is the most secure, but the question specifically requires allowing approved actions from the Marketplace, which includes verified partners, making the granular allow-list approach in Option D the correct balance of security and flexibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'Allow actions created by GitHub and verified partners' policy and add specific actions to the allow list.
The 'Allow actions created by GitHub and verified partners' policy, combined with an explicit allow list, provides granular control over which actions can run in workflows. This approach blocks unverified third-party actions by default while permitting specific approved actions from the Marketplace, directly addressing the need to enforce only approved actions without unnecessarily restricting all third-party actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a manual approval process for each new action.
Why it's wrong here
Manual review is not scalable.
- ✗
Set the organization to disallow all third-party actions.
Why it's wrong here
This may block needed actions.
- ✗
Configure the organization to allow only actions created by GitHub.
Why it's wrong here
This blocks all marketplace actions, which is too restrictive.
- ✓
Use the 'Allow actions created by GitHub and verified partners' policy and add specific actions to the allow list.
Why this is correct
This provides granular control over allowed actions.
Go deeper
Related to this question
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses GitHub Actions and needs to enforce that all workflows must use approved actions from a curated list. What is the best way to implement this?
hard- A.Configure branch protection rules
- ✓ B.Set up an allowed list of actions in organization settings
- C.Enable Dependabot alerts
- D.Use OpenID Connect (OIDC)
Why B: GitHub Organizations allow administrators to define an 'allowed list' of actions under Settings > Actions > Policies, restricting workflow execution to only approved actions from the curated list. This directly enforces the requirement that all workflows use only approved actions, preventing the use of unverified or malicious third-party actions.
Variation 2. Your organization uses GitHub Actions for CI/CD. The security team requires that all workflows are stored in a central repository and that only approved actions can be used. What should you implement?
medium- A.Configure the repository to use only self-hosted runners.
- B.Store all workflows in a central repository and use branch protection rules.
- ✓ C.In the organization settings, configure the 'Actions permissions' to 'Allow specified actions' and add the approved actions to the allow list.
- D.Enable 'Allow GitHub Actions to create and approve pull requests' in the repository settings.
Why C: The security team's requirement to restrict workflows to only approved actions is directly met by configuring 'Actions permissions' in the organization settings to 'Allow specified actions' and then populating the allow list with the approved actions. This enforces a policy where any workflow, regardless of where it is stored, can only reference actions that have been explicitly allowed, preventing the use of unverified or malicious third-party actions.
Variation 3. Your team uses GitHub Actions for CI/CD. You need to enforce that all workflows use approved actions from a private marketplace. Which GitHub feature should you configure?
hard- A.Use environment secrets to store allowed action names.
- B.Require self-hosted runners.
- ✓ C.Set the Actions permissions to 'Allow only specified actions'.
- D.Configure OpenID Connect (OIDC) for Actions.
Why C: The 'Allow only specified actions' setting in GitHub Actions permissions allows you to restrict workflow execution to a curated list of actions from a private marketplace or specific verified publishers. This enforces governance by preventing the use of unapproved actions, which is critical for compliance and security in enterprise CI/CD pipelines.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.