You use Azure Pipelines to build and deploy App1 and must ensure that, before deployment, all code passes a security validation performed by a custom tool. What should you do?

Adding a status check to branch policies is the correct approach because it integrates directly into the pull request workflow. This ensures that the custom security tool runs and reports its status before code can be merged into the target branch (e.g., main), effectively blocking deployments of unvalidated code. Branch policies are applied to specific branches or branch folders, making them ideal for department-wide enforcement. Adding a status check to only the main branch policies would work for that specific branch but wouldn't enforce the validation on other branches or for all developers in the department. Adding a service hook would notify an external service, but it wouldn't inherently block merges or deployments based on the tool's output. Limiting job authorization scope is a security best practice for pipelines but doesn't address the requirement of enforcing a pre-deployment security validation.