Question

Your company runs a background service that authenticates to Microsoft Graph as a daemon using an app registration with a client secret. The security team requires that credentials be rotated regularly and no longer permit long-lived shared secrets that could be extracted from configuration files. You must reconfigure the app to authenticate in a way that eliminates stored secrets while still supporting the client credentials flow. What should you configure for the app registration?

Accepted Answer

Add a certificate credential and configure the service to authenticate with a private key held in a certificate store or key vault

Answer

Create a new client secret with a maximum expiration of 24 months and store it in an environment variable

Answer

Assign a system-assigned managed identity to the app registration

Answer

Enable public client flows on the app registration and use the device code flow