Restricting Merges to Main Until a Production-Like Deploy Succeeds
Your team uses a Git flow branching strategy with develop and release branches. You want to enforce that only release branches can be merged into main, and all merges into main require a successful deployment to a production-like environment. How should you implement this in Azure Pipelines?
Quick Answer
A YAML pipeline combining environment approvals with branch filters on the trigger enforces both requirements at once: branch filters restrict which branches can even trigger the pipeline, and environment approvals require manual sign-off tied to a successful deployment to the production-like environment. Branch policies alone only govern PR reviews, not deployment gating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
YAML pipeline with environment approvals and branch filters on trigger
A YAML pipeline with environment approvals can require manual approval for deployment to a production-like environment, ensuring only successful deployments from a production-like environment allow merges. Branch filters on triggers can restrict pipeline execution to only release branches, preventing other branches from triggering the pipeline that leads to main. Option A is wrong because branch policies with required reviewers only enforce PR review requirements, not deployment or branch source restrictions. Option B is wrong because the 'Check for linked work items' status check ensures work items are linked but does not enforce branch restrictions or deployment validation. Option D is wrong because build validation runs on PR creation but does not enforce environment approvals or restrict the source branch to release branches only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Branch policy with required reviewers for main
Why it's wrong here
Required reviewers do not enforce deployment checks.
- ✗
Required status check for 'Check for linked work items'
Why it's wrong here
This does not restrict branch sources or require deployment.
- ✓
YAML pipeline with environment approvals and branch filters on trigger
Why this is correct
Environment approvals enforce manual sign-off, and branch filters ensure only release branches trigger deployment.
- ✗
Build validation policy on main
Why it's wrong here
Build validation runs on PR creation, not on merge, and does not enforce deployment.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Branch
A branch is a pointer to a specific commit in a version control system that allows you to work on features or fixes in isolation from the main codebase.
Key term
Check
A Check in Azure DevOps is a gating mechanism that evaluates predefined conditions before allowing a pipeline deployment to proceed to a specific environment.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses Azure Pipelines for CI/CD. You need to ensure that only approved branches can trigger production deployments. Which feature should you use?
easy- A.YAML template expressions
- ✓ B.Branch control for environments
- C.Deployment gates
- D.Pipeline decorators
Why B: Branch control for environments in Azure Pipelines allows you to restrict which branches can trigger deployments to specific environments, such as production. By configuring branch filters on an environment, you ensure that only approved branches (e.g., main or release branches) can initiate a production deployment, providing a security and governance boundary.
Variation 2. You have a YAML pipeline that deploys to multiple environments. The pipeline uses environment approvals. You need to ensure that the pipeline waits for manual approval before deploying to the production environment. The production environment is named 'Production'. Which configuration should you add to the deployment job?
hard- ✓ A.Add 'environment: Production' to the deployment job and configure approvals on the environment in the Azure DevOps portal
- B.Add 'approvals: Production' to the deployment job
- C.Add 'checks: Production' to the deployment job
- D.Add 'dependsOn: ProductionApproval' and use a separate stage for approval
Why A: Environment approvals in Azure DevOps are configured on the environment resource itself, not in the pipeline YAML. By adding 'environment: Production' to the deployment job, the pipeline references the environment, and the manual approval gate is enforced by the approvals configured on that environment in the Azure DevOps portal. This ensures the pipeline waits for approval before proceeding to the production deployment job.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.