AZ-400 Designing and Implementing Microsoft DevOps Solutions Exam

Seeking the thrill of transformative tech? Explore the art of designing and implementing DevOps solutions on Azure. Master the shift towards CI/CD, testing, and delivery, while preparing for the Designing and Implementing Microsoft DevOps Solutions exam!

Intermediate

Gauge your current knowledge

Track Readiness

Set Exam Goal

Intermediate

Gauge your current knowledge

Track Readiness

Set Exam Goal

Design and implement permissions and roles in GitHub

Design and implement authentication and authorization methods

Design and Implement Permissions and Roles in GitHub

Configure and Validate GitHub Access Controls

Roles and Permissions

GitHub provides built-in roles such as Owner, Admin, Maintainer, and Developer, each with distinct access levels. The Owner role gives full control over the organization, including sensitive settings, while Admin can manage repositories and their settings but cannot access organization-level administrative features. Maintainers maintain repositories without being able to delete them, and Developers contribute code without managing repository settings. Customizing these roles lets you assign the exact access needed for specific tasks, reducing the risk of unauthorized changes. Roles flow from the organization level down to individual repositories, so a user's effective permissions are the result of combining their organization role, team membership, and any direct repository invitations.

Branch Protection Rules

Branch protection rules enforce required approvals and checks before code merges into critical branches. You can require pull request reviews, enforce that specified status checks pass before merging, and restrict which users or teams can push to the branch. These rules interact with the pull request workflow: a pull request cannot be merged until all mandatory reviews are completed and every required status check (such as a CI build or security scan) reports success. This protects the branch from unauthorized or unverified changes and ensures that only code meeting the team's standards reaches the main branch.

Azure Active Directory Integration

Integrating Azure Active Directory (AAD) with GitHub centralizes identity management for the entire organization. When AAD is connected, users authenticate through AAD single sign‑on (SSO) rather than using a separate GitHub account, making AAD the single source of truth for user identities. AAD conditional access policies can then control who may access GitHub resources and under what conditions—for example, requiring multi‑factor authentication from outside the corporate network. This integration lets administrators validate that access policies align with organizational security and compliance standards, and it simplifies auditing by tying GitHub activity back to centrally managed identities.

...

A process flow showing a pull request moving through required reviews, status checks, and branch protection rules before merging into the protected main branch.

Sample Question

A development team manages a critical application's source code in a GitHub repository. They need to implement a robust security and compliance plan for their `main` branch to ensure code quality and prevent unauthorized changes. The organization uses Microsoft Entra ID for centralized identity management. The team has identified the following requirements: * Direct pushes to the `main` branch must be strictly prohibited. * All code changes must go through a pull request process, requiring at least two approved reviews before merging. * Automated CI build and security scanning checks must pass successfully before a pull request can be merged into `main`. * All GitHub users must authenticate via Microsoft Entra ID, and their access policies should be validated against corporate standards. Which combination of GitHub and Azure features should the team implement to meet these set of requirements?

GitHub Branch Protection Rules, GitHub Organization and Team Roles, and Microsoft Entra ID integration for SAML SSO.
GitHub repository-level permissions, manual code review policies, and GitHub Personal Access Tokens (PATs).
GitHub webhooks for external validation, individual user repository collaborators, and Azure AD Conditional Access without SAML SSO.
Azure Policy for GitHub repositories, Azure AD Identity Protection, and GitHub Actions for manual approvals.

View the answer & explanation →

Implement and manage Azure DevOps service connections and personalaccess tokens Design and implement permissions and security groups in Azure DevOps

AZ-400 Designing and Implementing Microsoft DevOps Solutions Exam

Design and implement permissions and roles in GitHub

Design and Implement Permissions and Roles in GitHub

Configure and Validate GitHub Access Controls

Roles and Permissions

Branch Protection Rules

Azure Active Directory Integration

Branch Protection and PR Workflow

Sample Question

Design and Implement Permissions and Roles in GitHub

Configure and Validate GitHub Access Controls

Roles and Permissions

Branch Protection Rules

Azure Active Directory Integration