ESEN

← Fine print by exam

Microsoft Azure · Expert

AZ-400 · Designing and Implementing Microsoft DevOps Solutions

Microsoft Certified: DevOps Engineer Expert

Current↗ Official guide🃏 Practice these gotchas

Secretless CI/CD deployments (OIDC federation)

IAM● verified 34 days ago◌ no external reviewer

The subject must match exactly, with no wildcards, and there are at most 20 credentials per identity

In Azure trust isn't a policy: each federated identity credential is an issuer + subject pair that must match the token's sub character by character. There are no wildcards, so you need one credential per environment, branch or tag, capped at 20 per identity. In AWS or GCP you'd use StringLike or a CEL condition. Watch out: a wrong subject is created without error, and the failure only shows up at login.

Helps with:AZ-400SC-300
⚑ Report outdated

See it in the pattern →

Reliability● verified 34 days ago◌ no external reviewer

A freshly created credential can fail with AADSTS70021 for a few minutes

The credential takes time to replicate across the region. If the same pipeline creates it and uses it right away, the token exchange can fail with "No matching federated identity record found for presented assertion" even though the subject is right. Microsoft recommends waiting and retrying. If bootstrap and the first deploy run together, split them or add a retry with backoff.

Helps with:AZ-400
⚑ Report outdated

See it in the pattern →

Operations● verified 34 days ago◌ no external reviewer

Creating several credentials in parallel on the same identity returns 409

Concurrent writes of federated identity credentials under the same user-assigned identity are rejected with 409 Conflict. The azurerm provider creates them serially since 3.40, so a for_each won't break. In ARM or Bicep, though, a loop creates them in parallel: use serial mode (batchSize 1) or chain dependsOn.

Helps with:AZ-400
⚑ Report outdated

See it in the pattern →

IAM● verified 34 days ago◌ no external reviewer

With Contributor the pipeline can't create role assignments

Contributor does not allow assigning roles in Azure RBAC (it excludes Microsoft.Authorization/*/Write). If your Terraform assigns roles (say, an app's identity on a Key Vault), Contributor is not enough. The quick fix is giving the pipeline Owner or User Access Administrator, which is exactly what you don't want. The right fix is Role Based Access Control Administrator with a condition limiting which roles it can assign (and excluding privileged ones).

Helps with:AZ-104SC-500AZ-400
⚑ Report outdated

See it in the pattern →

IAM● verified 34 days ago◌ no external reviewer

Since 2026-07-15, new, renamed or transferred repos use a different sub format

GitHub adds the numeric IDs to the claim: repo:org@123/repo@456:environment:prod instead of repo:org/repo:environment:prod, so a recycled name doesn't inherit the trust. Older repos keep the old format unless they opt in. If you rename a repo, the sub changes and every exact credential stops matching. The module builds the subject with IDs when you pass them.

Helps with:AZ-400
⚑ Report outdated

See it in the pattern →