Question

A financial services company runs a set of automated batch jobs on an on-premises server that must authenticate to Microsoft Entra ID to call a custom API protected by Entra ID. Security policy prohibits storing long-lived client secrets in configuration files and requires that credentials be non-exportable and centrally revocable. The server cannot be joined to Entra ID and does not support managed identities. Which authentication approach should you recommend?

Accepted Answer

Register an app in Entra ID and authenticate the service principal using a certificate whose private key is stored in the server's hardware TPM-backed certificate store

Answer

Register an app in Entra ID and generate a client secret with a two-year expiration stored in an encrypted configuration file

Answer

Configure a user account with a strong password and use the resource owner password credentials (ROPC) flow for the batch jobs

Answer

Enable a system-assigned managed identity on the on-premises server and grant it API permissions