A tamarack inventory daemon on App Service keeps failing when its Entra app-registration client secret expires. How should the developer remove that secret-rotation hop?

App-registration client secrets create a rotation clock that eventually fails production. For the tamarack inventory daemon on App Service, the durable fix is to enable a managed identity on the App Service and authenticate to Azure resources with that identity instead of a client secret. The platform handles token acquisition; there is no secret string to store, expire, or page people about at 2 a.m. for that hop. Role assignments on the identity replace secret-based app-registration credentials for Azure data-plane calls.

Embedding a longer-lived client secret in the public React bundle fails because any secret in front-end code is visible to every visitor. Longer TTL only lengthens the window of compromise; it does not remove the secret-rotation problem and violates least privilege for a browser-delivered SPA.

Storing the client secret in Application Insights custom events fails because telemetry is not a secret store. Events can be queried by anyone with Insights access, may be retained and exported, and still leave a rotatable secret in the wrong channel.

Replacing App Service with a desktop EXE that hard-codes the secret forever fails on operations and security. Hard-coded secrets still expire or leak, desktop hosts are outside the App Service managed-identity model the exam expects, and moving platforms does not solve credential hygiene.

Exam caveat: managed identity covers Azure resource authentication; if a third-party API still requires a client secret, store that secret in Key Vault and have the managed identity read it—do not put the secret back in App Settings plaintext as the primary pattern. Operational check: disable or remove the old client secret after the identity path works, and verify the daemon still obtains tokens and completes its inventory calls.