Chapter 9 of 10 · Microsoft AZ-400
Develop a security and compliance plan
Service principals and managed identities, GitHub and Azure DevOps access, secrets, OIDC and security scanning.
- 3topics
- 18 minfast track
- 1diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Authentication and Authorization MethodsAZ-400 identity: service principals versus managed identities, GitHub Apps and tokens, Azure DevOps service connections, groups…6 min
- 2Managing Secrets and Secretless AuthenticationAZ-400 secrets: Azure Key Vault in pipelines, variable groups, OIDC workload identity federation, secure files and preventing…Diagram6 min
- 3Security and Compliance ScanningAZ-400 scanning: GitHub Advanced Security, CodeQL, Dependabot, secret and license scanning, Defender for Cloud DevOps security…6 min
About this chapter
What this chapter covers
Pipelines hold the keys to production, so they are a target. This domain is worth 10 to 15 percent of the exam. It covers authentication and authorization (service principals, managed identities, GitHub Apps and tokens, service connections and permissions), managing secrets in automation, including secretless sign in with OpenID Connect, and automated security and compliance scanning.
The key skill is removing standing secrets and broad rights from pipelines, and adding automatic scanning that blocks problems early.
How the topics fit together
- Authentication and authorization methods covers identities, tokens, service connections, roles and access levels.
- Managing secrets and secretless authentication covers Key Vault, workload identity federation and keeping secrets out of logs.
- Security and compliance scanning covers GitHub Advanced Security, Dependabot, Defender for Cloud and container scanning.
The best secret is the one that does not exist. Prefer managed identities and federated credentials to stored passwords.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft AZ-400 question bank has 766 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.