A Python job runs in an Azure container app and uses the Dataverse SDK for Python. The security team forbids storing passwords or client secrets in code or configuration, and the job must still authenticate to Dataverse. How should the developer supply credentials to the SDK client?

The Dataverse SDK for Python authenticates by accepting an Azure identity credential, meaning any object from the azure-identity library that can obtain a token through its get_token method. In Azure-hosted compute, a managed identity credential lets the workload request Microsoft Entra ID tokens without any stored secret, and the platform rotates the underlying credentials automatically. Dataverse then maps the managed identity's application ID to an application user, which must exist in the environment with an appropriate security role. Username and password connection strings are a legacy pattern for the .NET tooling, they store exactly the secret the security team forbids, and they bypass multifactor authentication. The Power Platform admin center does not issue personal access tokens for Dataverse data access; tokens come from Microsoft Entra ID. Dataverse has no environment-level API key and an app registration does not generate one; authorization comes from a bearer token, not a custom header. Exam caveat: during local development the same code can use a developer credential, and DefaultAzureCredential can choose between environments automatically, but a production job should use a defined workload identity. Operational check: confirm the container app has a managed identity assigned, create the matching application user, and verify that a WhoAmI-style call returns that application user.