A plug-in assembly has been linked to a Power Platform managed identity that has access to Azure Key Vault. Inside Execute, how should the plug-in code obtain an access token to call the Key Vault REST API?
Select an answer to reveal the explanation.
Short Explanation
Your plug-in's toolbox has a dedicated tool for this: IManagedIdentityService. You ask it for a token by scope, and it hands one back that you put in your Authorization header. The other tools in the box do totally different jobs.
Full Explanation
When a plug-in assembly or package is bound to a managed identity record, Dataverse makes IManagedIdentityService available through the IServiceProvider passed to Execute. The plug-in calls its AcquireToken method with the scopes of the target resource, such as the Key Vault scope ending in /.default, and receives an access token issued by Microsoft Entra ID for the linked identity. The code then sends that token as a bearer token in the Authorization header of its HTTPS request to Key Vault. IOrganizationServiceFactory creates IOrganizationService instances for Dataverse operations under a given user context; it has no capability to authenticate to Azure resources, and the vault URI is not a valid argument. ITracingService writes diagnostic messages to the plug-in trace log; it neither generates nor stores tokens, and writing secrets to traces would be a security issue. SharedVariables carry data that plug-ins in the same pipeline place there; Dataverse does not populate them with access tokens, and passing tokens between plug-ins that way would be fragile and insecure. Exam caveat: token acquisition depends on the federated credential and record being configured correctly for the current environment, so failures surface as Entra ID errors rather than code exceptions. Operational check: trace a non-sensitive part of the result, such as success or token length, never the token itself, and confirm the Key Vault call returns 200.