You use Bicep templates to deploy websites and Azure SQL and will automate deployments with Azure Pipelines using a self-hosted agent on two virtual machines. To minimize administrative effort, what should you do first?

Creating a service principal is the correct first step because it provides a secure and automated way for your Azure Pipelines (running on self-hosted agents) to authenticate and deploy resources to Azure. A service principal is essentially an identity for an application or service to access Azure resources, adhering to the principle of least privilege. Azure Automation accounts are used for process automation and runbooks, not directly for authenticating Azure Pipelines to deploy Bicep templates. User-assigned and system-assigned managed identities are primarily for Azure resources to authenticate to other Azure services without managing credentials. While managed identities can be used, a service principal is the standard and most straightforward approach for Azure Pipelines to deploy to Azure subscriptions, especially when self-hosted agents are involved.