AZ-400 Exam Dumps : Microsoft Azure DevOps Solutions

To ensure that your Azure Web App namedaz400-38443478-maincan retrieve secrets from an Azure Key Vault namedaz400-3844J478-kv1using a system managed identity with the principle of least privilege, follow these detailed steps:

Enable a System Managed Identity for the Azure Web App:

Navigate to the Azure Portal.

Go to the Azure Web Appaz400-38443478-main.

SelectIdentityunder theSettingssection.

In theSystem assignedtab, switch theStatustoOn.

ClickSaveto apply the changes.

Grant the Web App Access to the Key Vault:

Go to the Azure Key Vaultaz400-3844J478-kv1.

SelectAccess policiesunder theSettingssection.

Click onAdd Access Policy.

ChooseSecret permissionsand selectGetandList. This grants the app the ability to read secrets, adhering to the principle of least privilege.

Click onSelect principal, search for your Web App nameaz400-38443478-main, and select it.

ClickAddto add the policy.

Don’t forget to clickSaveto save the access policy changes.

Retrieve Secrets in the Web App Code:

In your Web App’s code, use the Azure SDK to retrieve the secrets.

For example, in a .NET application,you can use theAzure.IdentityandAzure.Security.KeyVault.Secretsnamespaces.

Utilize theDefaultAzureCredentialclass which will automatically use the system managed identity when running on Azure.

using Azure.Identity;

usingAzure.Security.KeyVault.Secrets;

var client = new SecretClient(new Uri( " " ), new DefaultAzureCredential());

KeyVaultSecret secret = await client.GetSecretAsync( " my-secret-name " );

string secretValue =secret.Value;

Replace " my-secret-name " with the actual name of the secret you want to retrieve.

By following these steps, your Azure Web App will be able to securely retrieve secrets from the Azure Key Vault using a system managed identity, without needingto store credentials in the code, and adhering to the principle of least privilege. Remember to replace the placeholder names with the actual names of your Web App and Key Vault.

Step 1: Understand the Requirements

You need to create a self-hosted agent for Azure Pipelines.

It will be hosted in a pod (for example, in Kubernetes).

All pipelines in Project1 should be able to use this agent pool named Pool1 .

Step 2: Create the Agent Pool in Azure DevOps

Go to your Azure DevOps organization :

In the bottom-left corner, click on the Organization settings gear icon.

In the left menu, click on Agent pools .

Click on Add pool .

Provide the following:

Pool name: Pool1

Pool type: Self-hosted

Grant access permission to all pipelines: Checked (so that all Project1 pipelines can use this pool)

Click Create .

Now you have an empty agent pool named Pool1 .

Step 3: Prepare the Self-hosted Agent as a Pod

You need to deploy an Azure Pipelines agent container as a pod . Here’s how to do it:

Option 1: Using Kubernetes directly (YAML deployment)

Create a Kubernetes deployment YAML file for the agent pod:

apiVersion: apps/v1

kind: Deployment

metadata:

name: azure-pipelines-agent

labels:

app: azure-pipelines-agent

spec:

replicas: 1

selector:

matchLabels:

app: azure-pipelines-agent

template:

metadata:

labels:

app: azure-pipelines-agent

spec:

containers:

- name: agent

image: mcr.microsoft.com/azure-pipelines/vsts-agent:latest

env:

- name: AZP_URL

value: " "

- name: AZP_TOKEN

valueFrom:

secretKeyRef:

name: azure-pipelines-token

key: token

- name: AZP_POOL

value: " Pool1 "

- name: AZP_AGENT_NAME

value: " agent-pod "

Create a Kubernetes secret for the personal access token (PAT) :

kubectl create secret generic azure-pipelines-token --from-literal=token= < your-PAT >

Note:

Replace < your-PAT > with a PAT that has “Agent Pools (Read & manage)” scope.

Replace {YourOrganizationName} with your actual Azure DevOps organization.

Deploy the pod:

bash

Copy

kubectl apply -f azure-pipelines-agent.yaml

Step 4: Validate the Agent Connection

Go back to Organization Settings > Agent pools > Pool1 in Azure DevOps.

You should see the agent pod connected and listed as online .

Step 5: Use the Pool in Pipelines

By default, all pipelines in Project1 will now have access to the Pool1 agent pool because you granted access during the pool creation.

In your pipeline YAML files, specify the pool name to use the self-hosted agent:

yaml

Copy

pool:

name: Pool1

Unattended config:

The agent can be set up from a script with no human intervention. You must pass --unattended and the answers to all questions.

To configure an agent, it must know the URL to your organization or collection and credentials of someone authorized to set up agents. All other responses are optional.