Northwind Bank is building an unattended Copilot Studio agent that runs on a schedule to read from Azure Blob Storage and write summarized results to Azure SQL Database. No human interaction occurs during the agent's run. The security team mandates that no client secrets or certificates be stored in application settings or environment variables. Which Entra ID identity strategy should the solution architect recommend?
Select an answer to reveal the explanation.
Short Explanation
Managed identity is like a badge that Azure issues and renews automatically — the resource proves who it is without carrying a password. You should assign a system-assigned managed identity to the resource hosting the agent's Power Automate flows, then grant it RBAC roles on Blob Storage and SQL. That way, you eliminate stored secrets and let Azure manage the credential lifecycle.
Full Explanation
Managed identities are the preferred credential strategy for Azure-to-Azure communication when no human is in the loop. When you enable a system-assigned managed identity on an Azure resource (such as the Azure Logic Apps or Power Automate environment that runs the flows), Azure creates a corresponding service principal in Entra ID and automatically rotates its credentials. You then assign Azure RBAC roles — for example, 'Storage Blob Data Reader' and 'SQL DB Contributor' — to that managed identity, and the resource authenticates to those services without any stored secret. The system-assigned managed identity approach is correct and directly satisfies the security team's requirement: no client secrets, no certificates in application settings or environment variables.
The Key Vault client secret approach is wrong. While storing a secret in Key Vault is better than plain-text environment variables, it still requires the agent to possess a credential (the secret) and adds a Key Vault retrieval dependency. The security mandate explicitly prohibits stored secrets of any kind in application settings.
The shared service-account OAuth token approach is wrong. User-delegated tokens tie the agent's permissions to a human account, which violates the principle of least privilege for unattended workloads. If that account's password changes or the account is disabled, the agent breaks. User accounts are also subject to MFA policies that unattended processes cannot satisfy.
The Entra ID app certificate stored in Copilot Studio configuration approach is wrong. Copilot Studio's configuration panel does not support storing Entra ID certificates directly, and this approach still requires managing a certificate lifecycle — which is precisely what managed identities eliminate.
Exam tip: When a question mentions 'unattended,' 'scheduled,' or 'no secrets in configuration,' the answer almost always involves managed identities. Distinguish between system-assigned (tied to one resource, deleted with it) and user-assigned (portable, shared across resources); system-assigned is the simpler choice for single-resource scenarios.