Task 4.1: Design and implement authentication and authorization methods

• AA system-assigned managed identity enabled on each VM

  Incorrect

  System-assigned identities are deleted with their VM, so the role assignments would be lost every week.

• BA service principal with a client secret stored in a file on each VM

  Incorrect

  A secret on the VMs is the stored credential the design must avoid.

• CA personal access token from the platform team lead

  Incorrect

  A personal token ties automation to one person and is still a stored secret.

• DA user-assigned managed identity assigned to the scale set

  Correct

  It's a standalone resource that several VMs can share, so its role assignments outlive the rebuilt VMs.

A system-assigned managed identity shares its resource's lifecycle and is deleted with it. A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple resources, and Microsoft recommends it for Microsoft services. Azure manages the credentials of both.

• AClient secrets with a two-year lifetime and a calendar reminder to renew them

  Incorrect

  Longer-lived secrets are still secrets, and renewals still fail when forgotten.

• BCertificates uploaded to each app registration instead of secrets

  Incorrect

  Certificates also expire and must be stored and rotated.

• CService connections that authenticate with workload identity federation, using existing user-assigned managed identities

  Correct

  Federation exchanges short-lived tokens with no stored secret, and the managed identity option works without creating app registrations.

• DA personal access token stored in a variable group

  Incorrect

  A PAT authenticates to Azure DevOps, not to Azure Resource Manager.

Microsoft recommends Azure Resource Manager service connections that use workload identity federation, with an app registration or a managed identity; the managed identity option suits teams that can't create app registrations. Federation avoids storing and rotating secrets. New connections use the Microsoft Entra issuer; the Azure DevOps issuer retires on 1 July 2027.

• AA GitHub App installed on the organization with only the needed permissions

  Correct

  GitHub Apps have fine-grained permissions and generate short-lived tokens as the app, not as a user.

• BA fine-grained personal access token from a shared machine user account, rotated every year

  Incorrect

  A machine user is still a user account whose long-lived token must be stored and rotated.

• CThe workflow's GITHUB_TOKEN, passed to the bot's service

  Incorrect

  GITHUB_TOKEN is scoped to one workflow run in one repository, not 150 repositories.

• DAn SSH key registered to the leaving engineer's account

  Incorrect

  SSH keys authenticate Git operations, not API calls for labels and comments, and are tied to the user.

GitHub Apps are the recommended way to integrate automation with the GitHub API: they have fine-grained permissions and generate scoped, short-lived access tokens. GITHUB_TOKEN is generated for a workflow run and scoped to its repository, and personal access tokens act as a user.

• ABasic

  Correct

  Basic is the lowest level that includes Azure Repos.

• BStakeholder with Contributor permissions

  Incorrect

  Stakeholders don't get repository access whatever their group.

• CBasic + Test Plans

  Incorrect

  That works but adds paid Test Plans features she doesn't need.

• DProject Collection Administrator

  Incorrect

  That's a permission group, not an access level.

Stakeholders don't have access to code repositories; users who contribute to the codebase need at least Basic access.

• AGrant access to all pipelines and remove it later

  Incorrect

  Any pipeline could use the connection meanwhile.

• BCreate a separate project for the two pipelines

  Incorrect

  A new project isn't needed to restrict one connection.

• CShare the connection's secret with the two pipeline owners

  Incorrect

  Sharing secrets isn't access control.

• DLeave the option off and authorize the two pipelines on the connection

  Correct

  Authorizing individual pipelines limits who can use the connection.

Granting access to all pipelines lets any pipeline use a service connection and isn't recommended; authorize each pipeline individually.

• AA system-assigned managed identity of the server

  Incorrect

  The server isn't an Azure resource, so it has no managed identity.

• BA Microsoft Entra service principal using federation or a certificate

  Correct

  Outside Azure, use a service principal and prefer federation or a certificate over a client secret.

• CAn administrator's user account with MFA disabled

  Incorrect

  A user account for automation, without MFA, is a poor choice.

• DAn Azure DevOps PAT

  Incorrect

  A PAT authenticates to Azure DevOps, not Azure APIs.

Prefer a managed identity for workloads hosted in Azure. For a service principal, prefer workload identity federation or a certificate over a client secret when the hosting environment supports it.

• AReaders

  Incorrect

  Readers can view, not administer.

• BProject Administrators

  Correct

  Project Administrators manage permissions, teams, areas and iterations.

• CProject Collection Build Administrators

  Incorrect

  That group manages build resources at the organization level.

• DContributors

  Incorrect

  Contributors work with content, not project settings.

Assign Project Administrators to users who manage user permissions, create or edit teams, modify team settings, define area or iteration paths, or customize work item tracking.