Azure ML Workspace Managed Identity Git Access

AI-300 By islever Editorial Last updated

Create and manage resources in a Machine Learning workspace

Short answer

D Configure the workspace to use a managed identity for repository access.

Question

A team uses a hosted Git repository to store training code and pipeline definitions of a machine learning experiment.
The team must ensure that access to the repository is granted without requiring each developer to store personal access tokens on their machines.
Repository access must be secure and centrally managed to reduce credential spread.
You need to enable secure access between an Azure Machine Learning workspace and the repository.
What should you do?
  1. Share a repository deploy key across all developers on the team.
  2. Generate a personal access token and store it in a pipeline variable.
  3. Require each developer to authenticate locally before every pipeline run.
  4. Configure the workspace to use a managed identity for repository access. Correct Answer

Key Takeaways

Managed identities eliminate the need for storing secrets like PATs locally by allowing the service itself to authenticate via Azure AD.

Learn how to configure Azure Machine Learning workspace managed identity for secure, centralized Git repository access without local tokens.

Common mistake: Choosing to share a deploy key (A) seems central but fails because it gives all developers direct access to the secret, violating least-privilege and audit principles.

Expert Analysis

The core challenge is securing access to a hosted Git repository while eliminating the need for individual developers to manage personal credentials. The requirement explicitly states that access must be "centrally managed" and reduce "credential spread," which directly conflicts with solutions involving shared secrets or per-user tokens.

Option D, configuring the workspace to use a managed identity, is the correct architectural pattern for Azure Machine Learning. A managed identity provides an automatically managed identity in Microsoft Entra ID (formerly Azure AD) that can be used by the workspace to authenticate to other services, including Azure Repos or external Git hosts supported by Azure ML. By assigning the workspace's managed identity the appropriate permissions on the repository, the authentication happens seamlessly at the platform level. Developers do not need to store Personal Access Tokens (PATs) locally, nor do they need to handle credential injection during pipeline runs.

Option A suggests sharing a deploy key. While this centralizes the secret, it violates security best practices because every developer has access to the same private key, making audit trails difficult and increasing risk if any single machine is compromised. It does not meet the "secure and centrally managed" criteria as well as IAM-based solutions.

Option B involves storing a PAT in a pipeline variable. This still requires an initial token generation and management step, and while variables can be encrypted, it introduces a static secret into the pipeline definition, which is less secure than ephemeral, identity-based authentication.

Option C requires local authentication before every run, which creates friction for developers and increases the likelihood of credential leakage on local machines, directly contradicting the goal of reducing credential spread.

Therefore, leveraging the workspace's managed identity is the only method that fully satisfies the requirements for centralized, secure, and credential-free access.

Official Reference

https://learn.microsoft.com/en-us/azure/machine-learning/how-to-setup-authentication

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions emphasize 'centralized management' and 'reducing credential spread' for Azure PaaS resources, always look for Managed Identity or Service Principals over shared keys or local tokens. Verify that the resource being authenticated (e.g., Workspace) supports system-assigned managed identities for external integrations like Git.

Frequently Asked Questions

Why is a managed identity better than a pipeline variable for Git access?

Managed identities provide automatic, rotation-free authentication via Azure AD without storing secrets in code or variables, significantly reducing the attack surface.

Does Azure ML support managed identity for GitHub specifically?

Yes, Azure ML workspaces can use managed identities to authenticate to Azure Repos and GitHub Enterprise Server, depending on the specific integration configuration.

More AI-300 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. PurpleBlue 👍 1 Answered D
    A managed identity assigned to the Azure Machine Learning workspace allows the workspace itself to authenticate to the Git repository (or other Azure resources) without any developer needing to generate, store, or manage a PAT locally
  2. exam_upskill 👍 1 Answered D
    D. Configure the workspace to use a managed identity for repository access.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Evaluating RAG Answer Quality with Measurable Techniques

S-grade

Azure ML Asset Registration for Reusability

S-grade

Assessing and Improving RAG Retrieval Quality Sequence

S-grade

Implementing RAG Flow with Microsoft Foundry and Azure OpenAI

S-grade

← Back to AI-300 Study Guide