Design and implement authentication and authorization methods

Contoso Pharma has an Azure DevOps organization named contoso-pharma with 12 projects. Priya, the lead engineer of the project LabSystems, must be able to add members to LabSystems groups, manage repository and pipeline permissions, and change project settings in LabSystems only. She must have no administrative rights over the other 11 projects or the organization, and least privilege is required.

To which security group should you add Priya?

1. AProject Collection AdministratorsProject Collection Administrators have administrative rights over every project and organization-level settings, which far exceeds the single-project scope.
2. BProject Administrators in the LabSystems projectProject Administrators can manage group membership, permissions, and settings for their project only, which matches the required scope exactly.
3. CContributors in the LabSystems projectContributors can work with code, work items, and pipelines, but they cannot manage security group membership or project-level permissions.
4. DBuild Administrators in the LabSystems projectBuild Administrators manage pipeline permissions and resources but cannot manage repository permissions, group membership, or project settings.

Tailspin Toys has a private repository named tailspin-mobile in its GitHub organization. A group of five customer support leads, all organization members, must be able to label, assign, close, and reopen issues and pull requests. They must not be able to push code to any branch, and least privilege is required.

Which repository role should you grant to the support leads' team?

1. AReadRead lets members view and comment on issues and pull requests, but it does not let them apply labels, assign, or close issues they did not open.
2. BTriageTriage is designed for people who manage issues and pull requests without write access to code: it adds labeling, assigning, closing, and reopening on top of Read.
3. CWriteWrite includes triage abilities but also allows pushing to branches, which exceeds what the support leads need.
4. DMaintainMaintain includes push access plus repository management such as editing many repository settings, which is far more than least privilege allows.

Wingtip Logistics has three squads named Routing, Billing, and Tracking that share the same Git repositories and release pipelines for a product called FleetHub. Each squad needs its own backlog and sprint board, and a portfolio manager needs a single view that rolls up work from all three squads. The solution must minimize administrative effort and avoid duplicating repositories, pipelines, and permission configurations.

How should you organize FleetHub in Azure DevOps?

1. ACreate one project named FleetHub with three teams, give each team its own area path under the project, and create a parent team for the portfolio manager whose area includes all three sub-areasTeams in one project share repositories, pipelines, and security while each team gets its own backlog and board filtered by area path, and a team that owns the parent area path rolls up all three squads' work.
2. BCreate three projects named FleetHub-Routing, FleetHub-Billing, and FleetHub-TrackingSeparate projects would require duplicating or cross-referencing repositories, pipelines, and permissions, and cross-project rollup is harder, which increases administrative effort.
3. CCreate one project with the default team only and distinguish squads by work item tagsTags can filter queries, but a single team has one backlog and one sprint board, so the squads would not get independent boards or sprint capacity planning.
4. DCreate three Azure DevOps organizations, one for each squad, and link them with Microsoft Entra IDSeparate organizations isolate billing, users, and all assets, which makes sharing repositories and pipelines and rolling up work much harder.

Adatum Insurance uses Azure Boards in the Azure DevOps project ClaimsPortal. Forty business analysts must create and update work items, comment on them, and view the project dashboards. They never need access to repositories, pipelines, or test plans, and minimizing licensing cost is the deciding factor.

Which access level should you assign to the business analysts?

1. AStakeholderStakeholder access is free and lets users add, edit, and comment on work items and view dashboards, which covers everything the analysts need.
2. BBasicBasic adds repositories and pipelines, which the analysts do not need, and it is a paid access level beyond the first five users.
3. CBasic + Test PlansBasic + Test Plans is the most expensive access level and is intended for users who create and manage test plans, which is out of scope.
4. DBasic, with the analysts added to the Readers groupThe Readers group would block the analysts from editing work items, and the Basic license still costs money for capabilities they never use.