Question

A financial services company is deploying autonomous AI agents and CI/CD workloads that run partly in Azure and partly in an external Kubernetes cluster hosted on another cloud. These agents must call Microsoft Graph and Azure-hosted APIs. Security leadership mandates that no long-lived client secrets or certificates be stored anywhere in the pipeline or the external cluster, and that each non-human identity be independently governable, auditable, and subject to Conditional Access. As the cybersecurity architect, which identity design best meets these requirements?

Accepted Answer

Use system-assigned managed identities for the Azure workloads and configure workload identity federation so the external Kubernetes workloads exchange their cluster-issued tokens for Entra ID tokens without storing credentials.

Answer

Register each workload as an Entra ID app registration and distribute client secrets through Azure Key Vault, rotating them every 30 days via automation.

Answer

Create a single shared service principal with a certificate credential and grant it to all agents so access can be centrally revoked from one object.

Answer

Assign user accounts with Conditional Access exclusions to the agents and rely on PIM for just-in-time elevation of those accounts.