Question

Your team maintains a non-interactive Azure DevOps pipeline that uses the Azure CLI to deploy Azure AI Foundry resources and model deployments into a subscription. The pipeline currently fails at the deployment step because it cannot authenticate. Security policy forbids storing user credentials or interactive browser sign-in in the pipeline. Which authentication approach should you configure for the Azure CLI in the pipeline?

Accepted Answer

Authenticate 'az login' with a service principal using a workload identity federation (OIDC) service connection

Answer

Run 'az login' interactively and cache the token in the pipeline agent's user profile

Answer

Embed a personal access token for a named engineer in a pipeline variable and use it with 'az login'

Answer

Assign a system-assigned managed identity to the Azure DevOps organization and rely on it for CLI calls