A developer's integration works when they run it under their own account but must now run unattended in production. What should change?
Select an answer to reveal the explanation.
Short Explanation
Don't let a production job depend on one person still working there. Give it its own service identity with the narrowest permissions that work. Then the audit trail names the job, and staffing changes don't break the nightly run.
Full Explanation
The correct answer is the dedicated service identity with only the permissions the job needs. Unattended workloads need their own identity. A service principal scoped to the job's requirements makes access auditable as the application rather than as a person, and it survives that person changing role or leaving.
Keeping the developer's credentials but storing them in the application's configuration file is incorrect because embedding a personal credential in configuration means the job's actions are attributed to a human, and the job breaks whenever their password changes or their account is disabled.
Granting the developer's account administrator rights so the job cannot fail on a permission error is incorrect because escalating a personal account to administrator to avoid permission errors grants far more than the job needs and makes the eventual credential exposure much worse.
Running the job on the developer's workstation on a schedule so their session is available is incorrect because tying production to a workstation makes availability depend on one machine being awake, patched and logged in.
For the exam, the principle is a distinct service identity with least privilege for any unattended integration.