A county courts IT team needs CI pipelines to submit Azure Machine Learning pipeline jobs without interactive user login. What identity pattern should they use?
Select an answer to reveal the explanation.
Short Explanation
Don't rely on a workload identity federation with only Compute Operator rights to submit Azure ML jobs. Use a service principal or managed identity that is allowed to submit Azure ML jobs non-interactively. You won't pass the job-submission audit with a training-compute identity that your pipeline can't use or a service principal scoped to the container registry.
Full Explanation
A service principal or managed identity granted rights to submit Azure ML jobs from the automation pipeline is the correct identity pattern for county courts CI because continuous integration must authenticate non-interactively. Managed identities and service principals are first-class automation principals: they can be granted scoped rights to submit Azure Machine Learning pipeline jobs without caching a human's interactive session. That supports repeatable, auditable municipal CI while aligning with least privilege.
A workload identity federation granted Compute Operator rights to submit Azure ML jobs from the automation pipeline fails because Compute Operator rights only allow managing compute resources, not submitting pipeline jobs, so it cannot authorize CI job submission. A managed identity on the training compute granted rights to submit Azure ML jobs from the automation pipeline fails because it is attached to the training compute resource, not to the CI automation pipeline, so the pipeline cannot authenticate as it to submit jobs. A service principal for the container registry granted rights to submit Azure ML jobs from the automation pipeline fails because it is scoped as the registry identity for image operations, not as the automation pipeline identity, so the CI pipeline cannot use it to submit jobs.
Exam caveat: interactive user login is for people; service principals and managed identities are for pipelines and services. On Azure ML + DevOps questions, prefer non-interactive, scoped identities with job-submission rights for the automation pipeline over Compute Operator-only rights, training-compute-attached identities, or container-registry service principals.
Operational check: configure the pipeline to authenticate as the managed identity or service principal, grant only the Azure ML job-submit permissions required, rotate secrets if a client secret is used (prefer federated/managed identity), and confirm a CI run submits a pipeline job without any human portal login.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.