Question

A financial services company runs dozens of automated batch jobs and CI/CD pipelines in Azure that authenticate to APIs using Entra ID service principals with client secrets. A security review finds that many secrets have never been rotated, some are stored in code repositories, and there is no visibility into which service principals are risky or unused. The architect must design an identity governance approach for these non-human (workload) identities that reduces credential exposure and provides continuous risk detection. Which combination best meets these goals?

Accepted Answer

Replace client secrets with managed identities or federated workload identity credentials where possible, and enable Microsoft Entra Workload Identities Premium to detect risky and unused service principals with Conditional Access for workload identities.

Answer

Move all service principal secrets into Azure Key Vault and configure an Azure Automation runbook to email owners every 90 days reminding them to rotate secrets manually.

Answer

Enroll each service principal in Privileged Identity Management (PIM) and require MFA and approval each time a pipeline needs to authenticate to an API.

Answer

Convert all service principals to user accounts with strong passwords, apply a risk-based Conditional Access policy, and enforce interactive sign-in for every batch job.