AZ400-Q: scope a deployment identity
A pipeline deploys only to one resource group. It currently uses a service connection with Owner permission at subscription scope. What is the best correction?
- A) Create or reconfigure a deployment identity with only the required role at the resource-group scope and use it through the service connection/federation. ✓
- B) Keep Owner but store its secret in a different variable group.
- C) Give all pipeline contributors Owner so deployments cannot fail.
- D) Remove all authentication from the pipeline.
Answer: A. Least privilege limits the blast radius of a compromised or faulty pipeline while still allowing the required deployment.
Why not the others: Different secret storage does not reduce permissions. Broadening Owner worsens risk. Azure deployments require an authorized identity.
Related
subscription-connection · secretless-pipeline-authentication · rbac