The tugboat AKS cluster still hands every contractor the same cluster-admin kubeconfig certificate. How should the security engineer change authentication?
Select an answer to reveal the explanation.
Short Explanation
One shared cluster-admin kubeconfig is a master key passed around the pier. Hook AKS up to Microsoft Entra ID so each operator signs in as themselves.
Full Explanation
Microsoft Entra ID integration for AKS replaces shared cluster-admin client certificates with per-user sign-in using Entra identities. That is the authentication control this bullet targets. Application-level MSAL in microservices, parking the same admin cert in Key Vault, and over-privileged directory roles do not implement AKS Entra-integrated authentication. Domain 1 app-registration consent topics are out of scope for this item.