You have an Azure App Services web app named App1. You plan to deploy App1 by using Web Deploy. You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege. What should you do?

The Website Contributor role is the built-in Azure role designed with the principle of least privilege for this specific task. It grants permissions to manage the web app's settings and content, including the necessary Microsoft.Web/sites/publish/action permission required for Web Deploy. Assigning this role allows developers to authenticate using their Azure AD credentials for deployment without granting excessive permissions, such as managing the App Service Plan, virtual networks, or assigning roles to other users, which roles like Contributor or Owner would provide.

A. Assign the Owner role to the developers This role grants full access to all resources, including permission management, which violates the principle of least privilege.
B. Configure app-level credentials for FTPS These are shared credentials specific to the app, not individual Azure AD credentials, failing a key requirement of the question.
D. Configure user-level credentials for FTPS These are deployment credentials set at the Azure account level for FTP/S, and they are separate from Azure AD credentials. ---

1. Microsoft Learn | Azure built-in roles: The documentation lists the Website Contributor role and its purpose. The role definition includes the Microsoft.Web/sites/publish/action permission

which is essential for deploying code. This role is more constrained than Owner or Contributor.

Source: Microsoft Docs

"Azure built-in roles

" under the "Website Contributor" section.

Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#website-contributor

2. Microsoft Learn | Configure deployment credentials for Azure App Service: This document explains the different types of credentials for deployment. It distinguishes between account-level credentials and app-level credentials for FTP/S and Web Deploy

which are separate from Azure AD-based authentication provided by RBAC.

Source: Microsoft Docs

"Configure deployment credentials for Azure App Service

" sections "User-scope credentials" and "App-scope credentials."

Reference: https://learn.microsoft.com/en-us/azure/app-service/deploy-ftp?tabs=portal#deployment-credentials

3. Microsoft Learn | Role-based access control: This document outlines the principle of least privilege as a security best practice

which involves granting users only the permissions they need to perform their jobs. The Website Contributor role aligns with this principle for the described task.

Source: Microsoft Docs

"What is Azure role-based access control (Azure RBAC)?"

section "Best practices for Azure RBAC."

Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview#best-practices-for-azure-rbac