AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Microsoft Entra ID and Azure DevOps. You need to ensure that only users from specific Entra ID groups can create new Azure DevOps organizations. What should you configure?
⚠ Common exam trap
Candidates often confuse Conditional Access policies (which control sign-in and access) with administrative roles (which control resource creation permissions), leading them to select option C instead of the correct role-based option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the Azure DevOps Administrator role to the security group
The Azure DevOps Administrator role in Microsoft Entra ID is specifically designed to manage Azure DevOps service-level settings, including the ability to restrict who can create new Azure DevOps organizations. By assigning this role to a security group, only members of that group can create new organizations, which directly meets the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Global Administrator role to the security group
Why it's wrong here
Assigning the Global Administrator role to the security group grants full control over all Microsoft Entra ID administrative functions, including user management, security settings, and billing, which far exceeds the minimal privileges needed to create Azure DevOps organizations. This violates least-privilege principles and unnecessarily expands the attack surface.
- ✓
Assign the Azure DevOps Administrator role to the security group
Why this is correct
The Azure DevOps Administrator role in Microsoft Entra ID is specifically designed to grant permissions to manage Azure DevOps organizations, including creation. Assigning this role to a security group enables group-based assignment, ensuring that members have the precise privileges needed without overreaching, following the least-privilege model.
- ✗
Configure Conditional Access policies to block non-group members
Why it's wrong here
Conditional Access policies are used to enforce access control decisions during sign-in, such as requiring multifactor authentication or restricting access by device compliance, but they do not govern the ability to create new Azure DevOps organizations. Creation is an authorization action at the directory level, not an access control event, so this policy cannot block organization provisioning.
- ✗
Use Azure DevOps security policies to restrict organization creation
Why it's wrong here
Azure DevOps does not have a built-in security policy to restrict the creation of entire organizations; its security policies operate at project, repository, or pipeline levels, not at the directory level. The sole method to govern organization creation is through the Microsoft Entra ID Azure DevOps Administrator role, making this option technically infeasible.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.