AI-103 Practice Question 83: Pipeline OIDC vs Secret

Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 9 · question 3 of 10

Plan and manage an Azure AI solutionmedium

A platform team is building a GitHub Actions workflow that runs on every merge to main to deploy and update a Foundry resource and its model deployments. Security requires that the repository hold no long-lived secret that grants Azure access, and that nothing in the pipeline need manual rotation.

Which authentication approach satisfies both requirements?

Show answer and explanation

Answer:

C. Configure a federated identity credential on a Microsoft Entra app registration (or a user-assigned managed identity) that trusts the GitHub repository and workflow, then sign in with azure/login using OpenID Connect and only the client ID, tenant ID and subscription ID as GitHub secrets

With OpenID Connect (OIDC), the GitHub Actions runner presents a short-lived token issued by GitHub, and Azure exchanges it for an access token because of a federated identity credential configured in advance on an Entra application or user-assigned managed identity. Microsoft's own description of this flow is direct: "There are no secrets to manage, no credentials to rotate, and nothing sensitive stored in your repository." The values stored as GitHub secrets (client ID, tenant ID, subscription ID) are identifiers, not credentials; on their own they grant no access.

- A is wrong because a client secret is precisely the stored, expiring credential the security requirement rules out, and it hands the team a recurring rotation chore rather than removing it. - B is wrong because a personal access token ties the pipeline's identity to one person's account rather than a service identity, and it is still a stored secret subject to the same leakage and rotation problems as A. - D is wrong on the mechanics: a managed identity can be used only by the specific Azure resource it's assigned to. A GitHub-hosted runner is an external GitHub-managed VM, not that Azure resource, so it has no way to assume App Service's managed identity at all.

Reference: Authenticate to Azure from GitHub Actions by OpenID Connect

Practice Test 9 ›

Study guides for AI-103

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.

AI-200 exam guide: Azure AI Cloud Developer AssociateAI-200 replaced AZ-204: what the Azure AI Cloud Developer exam tests, how it differs from AI-103, price in USD and INR, format and how to prepare.

How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.

AI-901 exam guide: Azure AI Fundamentals after AI-900AI-901 replaced AI-900: learn what changed, how much Python and Microsoft Foundry you need, exam costs in India, and how to prepare.

Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.

Microsoft AI certification path 2026: which exam firstMicrosoft AI certification path for 2026 - AI-901, AB-730, AI-103, AI-200, AI-300, AB-100, AI-500 and GH-300 by role, and which exam to take first.

AI-103 Certification Guide: What Changed From AI-102The AI-103 certification replaced AI-102 in 2026. Exam format, cost, the five skill domains, what changed and how to prepare, with free practice questions.

What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.

Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.