Question

Your company runs a shared Azure DevOps project used by five product teams. Each team maintains its own YAML pipelines that deploy to separate Azure resource groups. Security requires that a pipeline for Team A must never be able to deploy to Team B's resources, even if a Team A member edits the pipeline YAML. All service connections currently exist at the project level and are open to any pipeline. What should you configure to enforce this isolation with the least ongoing administrative effort?

Accepted Answer

Create one service connection per team scoped to that team's resource group, disable 'Grant access permission to all pipelines', and add a pipeline permission authorizing only that team's pipelines to each connection.

Answer

Keep the project-level service connections but add a manual approval check on each so an administrator reviews every deployment before it runs.

Answer

Move all deployments to a single service connection scoped to the subscription and rely on YAML template parameters to select the correct resource group.

Answer

Create a separate Azure DevOps project for each team so that service connections cannot be shared across teams.