Azure API Management still presents a username and password from a named value when calling the canal backend. What should the security engineer recommend?

Azure API Management that still presents a username and password from a named value when calling the canal backend should move to authentication-managed-identity so the gateway authenticates to the backend with a managed identity token. If a secret must still exist for a transitional backend, source it from Key Vault-backed named values rather than pasting long-lived passwords into configuration. That removes standing canal credentials from APIM policy surfaces and aligns backend auth with Entra-managed identities used elsewhere in the municipal estate.

Pasting a longer password into the named value and rotating it manually each quarter fails by concept: length and quarterly rotation still leave a shared password in configuration and do not adopt managed-identity authentication. Storing the backend password in plain text in the APIM policy XML so operators can read it during incidents fails because embedding secrets in policy XML increases disclosure risk and contradicts secret hygiene. Disabling TLS to the backend so credential headers are easier to troubleshoot fails by weakening transport security while leaving password-based auth in place.

Exam caveat: authentication-managed-identity is the preferred APIM-to-backend pattern; Key Vault references for named values are the fallback when a secret remains unavoidable—deep Key Vault access-policy design is a related but separate domain topic. Operational check: enable a managed identity on the APIM instance, grant it the backend’s required app role or RBAC, switch the backend policy to authentication-managed-identity, remove hardcoded passwords from named values, and verify canal backend calls succeed without password headers.