When integrating GitHub as the repository for an existing Azure DevOps project, which authentication mechanism ensures Azure Pipelines runs under the Azure Pipelines identity?

A GitHub App is the recommended and most secure authentication mechanism for integrating GitHub with Azure Pipelines, especially when you want pipelines to run under the Azure Pipelines identity. It provides granular permissions, is installed directly on GitHub organizations or repositories, and doesn't rely on a user's personal credentials, making it ideal for automated systems. A Personal Access Token (PAT) is tied to a specific user and can be less secure for system-to-system integration as it grants permissions based on that user's access. Azure Active Directory (Azure AD) is primarily for authenticating users to Azure services, not for direct integration with GitHub. OAuth is a general authorization framework, but a GitHub App provides a more robust and purpose-built solution for this specific integration, offering better control and security for pipeline execution.