SC-100 Certification Practice Question #23

Question

You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain.

You are designing an Azure DevOps solution to deploy applications to an Azure subscription by using continuous integration and continuous deployment (CI/CD) pipelines.

You need to recommend which types of identities to use for the deployment credentials of the service connection. The solution must follow DevSecOps best practices from the Microsoft Cloud Adoption Framework for Azure.

What should you recommend?

Accepted Answer

The Microsoft Cloud Adoption Framework DevSecOps guidance is explicit: for CI/CD service identities deploying to Azure, use a user-assigned managed identity or service principal and "never use a user account." A managed identity is auto-managed by Azure with no secrets to store or rotate, satisfying "minimize credential management" and DevSecOps best practice. Options B and D are both user accounts (PIM role assignment or a Key-Vault-stored password don't change the account type and still leave a credential to manage), and option C, a gMSA, is an Active Directory Domain Services account used for on-premises Windows services, not an Azure DevOps service connection. The Suggested Answer, the overwhelming community vote (21), and the top comments all agree, so confidence is high; a small Key-Vault dissent exists but is outweighed by the "never use a user account" guidance.

More SC-100 practice questions