Question

You are building an Azure Function (running on an App Service plan) that must call the Dataverse Web API to update account records nightly. Security policy prohibits storing any client secrets or certificates in application settings or code. The Function should authenticate to Dataverse using its own identity. Which approach should you implement?

Accepted Answer

Enable a system-assigned managed identity on the Function, create an application user in Dataverse mapped to that identity, and acquire a token for the Dataverse resource using the managed identity.

Answer

Register an app in Microsoft Entra ID, generate a client secret, store it in the Function's application settings, and use the client credentials flow to authenticate.

Answer

Store an administrator's username and password in Azure Key Vault and use the resource owner password credentials (ROPC) flow to obtain a Dataverse token.

Answer

Use the Function's built-in App Service authentication (Easy Auth) with an interactive login to acquire a delegated Dataverse token at runtime.