You have an Azure DevOps organization named Contoso and a project named Project1. You provisioned an Azure Key Vault named Keyvault1. To reference Keyvault1 secrets in a build pipeline for Project1, what should you do first?

To reference Azure Key Vault secrets in an Azure DevOps pipeline, you must first create a variable group. This variable group can then be linked to an Azure Key Vault, allowing you to securely access its secrets as variables within your build or release pipelines. Adding a secure file is for storing files securely, not for directly referencing Key Vault secrets. Creating an XAML build service is an outdated approach for on-premises Team Foundation Server and is not relevant for Azure DevOps pipelines. Configuring the security policy of Contoso is too broad; while permissions are necessary, creating the variable group is the direct mechanism for linking to Key Vault.