A company connects Azure DevOps pipelines to its Azure subscriptions and wants the safest way to authenticate those service connections. Which option is preferred?
Show answer and explanation
Answer: A
Workload identity federation establishes trust between the pipeline and Microsoft Entra ID, so no long-lived secret is stored and tokens are issued only for the job. Granting the identity minimal role assignments limits what a compromised pipeline can do. Shared identities erase accountability, personal accounts break when people leave, and secrets in YAML are exposed to anyone who can read the repository.
Why the other options are wrong
- B. A shared identity across projects means one leaked secret exposes every subscription it touches, and audit logs cannot show which pipeline acted.
- C. Personal accounts tie production automation to one individual, stop working when that person leaves, and bypass the controls designed for service identities.
- D. A secret in pipeline YAML is visible to anyone with repository read access and remains valid until someone manually rotates it.