Your team uses Azure Pipelines YAML to deploy Bicep templates to an Azure subscription. Security policy now prohibits storing long-lived secrets, and the security team has flagged your existing service principal service connection because its client secret expires and must be rotated manually. You need to reconfigure the pipeline's authentication to Azure so that no stored secret is used and credentials are short-lived, while requiring the least ongoing maintenance. What should you do?