SC-100 Certification Practice Question #110

Question

You have an Azure subscription and an Azure DevOps organization.

You need to recommend a solution for connecting Azure DevOps pipelines to the resources in the subscription by using Azure Resource Manager (ARM) service connections. The solution must align with Microsoft Cloud Adoption Framework for Azure best practices, including the principle of least privilege.

What should you include in the recommendation?

Accepted Answer

Both B and C use workload identity federation (secret-free OIDC), which CAF mandates. The distinguishing factor is the identity type. MS Learn's CAF security-considerations guidance and the Azure DevOps service-connection docs list app registration (service principal) with workload identity federation as the primary/automatic recommended option, with user-assigned managed identity offered as the alternative specifically for when you lack permission to create an app registration. Since the question asks for the general CAF-aligned least-privilege recommendation with no such permission constraint stated, B (workload identity federation + service principals) is the best fit, matching both the Suggested Answer and the top community vote. Confidence is held at 80% because a meaningful minority votes C and Microsoft does present UAMI favorably for subscription-vending scenarios, so the two options are close.

More SC-100 practice questions