A lock-scheduling daemon authenticates as a service principal yet still stores a storage account key on disk. What should the security engineer do?
Select an answer to reveal the explanation.
Short Explanation
A key on disk is a spare house key taped to the door. Give the service principal the right Azure RBAC role on the storage scope and throw the account key away.
Full Explanation
Service principals are first-class Azure RBAC security principals. Assigning a least-privilege built-in role at the storage account or resource-group scope lets the daemon access data or management APIs with Microsoft Entra authentication instead of a shared key on disk. Extending secrets or relocating plaintext keys does not remove the key-based risk. Shared mailboxes are not Azure resource principals for this pattern.