Microsoft DevOps Engineer Expert AZ-400 Practice Question

Installing or updating extensions is an organization-level task that is controlled by the Manage extensions permission. By default, that permission is set to Allow only for members of the Project Collection Administrators group. Other built-in groups, such as Project Administrators or Team Administrators, are scoped to a single project and do not have organization-wide extension permissions. Project Collection Build Service is a service principal used by pipelines and has no administrative rights. Therefore, adding the user to the Project Collection Administrators group is required and sufficient to let the user manage extensions while introducing no additional project-level privileges beyond those inherently held by that group.