AZ-104 practice question 1 of 35

You have an Azure App Services web app named App1. You plan to deploy App1 by using Web Deploy. You need to ensure that the developers of App1 can…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Deploy and manage Azure compute resources

You have an Azure App Services web app named App1. You plan to deploy App1 by using Web Deploy. You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege. What should you do?

Answer options

Correct Answer:

Explanation

To enable developers to use their Azure AD credentials for deploying content to an Azure

App Service web app (App1) via Web Deploy while adhering to the principle of least

privilege, you should assign them the "Website Contributor" role. This Azure built-in role

grants permissions to manage the web app's content and settings, including deployment

operations, without granting excessive permissions like those provided by the "Owner" role.

Web Deploy leverages the Kudu (SCM) service, which supports authentication using Azure

AD credentials for users who have appropriate RBAC permissions on the App Service

instance.

Why Incorrect

A. Assign the Owner role to the developers: The Owner role grants full access to all

resources in the scope, which violates the principle of least privilege as it provides far more

permissions than needed for deploying web content.

B. Conﬁgure app-level credentials for FTPS: This option refers to FTPS, not Web Deploy,

and app-level credentials are not Azure AD user credentials.

D. Conﬁgure user-level credentials for FTPS: This option also refers to FTPS, not Web

Deploy. While user-level credentials for FTPS can be linked to Azure AD, the question

speciﬁcally asks for Web Deploy.

References

Azure built-in roles - Website Contributor: Microsoft Learn. "Azure built-in roles." (Search for

"Website Contributor"). This role "Lets you manage websites (not web plans)..." and

includes permissions like Microsoft.Web/sites/ which covers deployment.

URL: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-inroles#website-contributor

Deployment credentials - Azure App Service: Microsoft Learn. "Deployment credentials -

Azure App Service." This document mentions that for authorizing against the SCM endpoint

(used by Web Deploy), you can use "Your Azure AD user (for RBAC-based authorization)."

URL: https://learn.microsoft.com/en-us/azure/app-service/deploy-ftp?tabs=portal#authorizeagainst-the-scm-endpoint (While the main article is about FTP, this section covers SCM

endpoint authorization which is relevant for Web Deploy).

Principle of Least Privilege: Microsoft Learn. "What is the principle of least privilege?"

URL: https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-leastprivileged-access (General concept, applicable here).

Question 1 of 35

Question breakdown

Tests: Configure deployment access for Azure App Service
Difficulty: Medium

Key idea: Web Deploy through the Kudu/SCM endpoint can authenticate Microsoft Entra ID (Azure AD) users who hold an RBAC role with write access to the web app, and Website Contributor is the narrowest built-in role that grants this.

How to reach the answer

The clue 'use their Azure AD credentials' rules out FTPS deployment credentials, which are separate username/password pairs.
Web Deploy targets the SCM (Kudu) endpoint, which accepts Entra ID tokens for users with suitable RBAC permissions on the site.
The clue 'principle of least privilege' means picking the narrowest role that can still write site content.
Owner works but is far broader than needed. Website Contributor manages web apps without granting access management or plan control, so it fits.

Each option

AIncorrect. Owner allows deployment but also grants full resource management and role assignment rights, which breaks least privilege.
BIncorrect. App-level credentials are auto-generated publishing credentials tied to the app, not the developers' Azure AD identities.
CCorrect. Website Contributor lets developers authenticate with Azure AD and deploy to the web app without unnecessary extra permissions.
DIncorrect. User-level deployment credentials are a separate username and password defined for deployment, not the developers' Azure AD sign-in.

Common trap: 'User-level credentials' sounds like personal identity, but these are standalone deployment credentials and are not Azure AD accounts.

In practice: Teams often turn off basic publishing credentials (SCM/FTP basic auth) for security. They then give developers Website Contributor on specific apps so deployments use Entra ID identities and leave an audit trail.

Remember: Azure AD-based deployment to App Service means granting an RBAC role, and Website Contributor is the least-privilege choice for one web app.

Official documentation: Azure built-in roles · Configure deployment credentials for Azure App Service

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free AZ-104 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test