Northwind Bank is building an unattended Copilot Studio agent that runs on a schedule to read from Azure Blob Storage and write summarized results to Azure SQL Database. No human interaction occurs during the agent's run. The security team mandates that no client secrets or certificates be stored in application settings or environment variables. Which Entra ID identity strategy should the solution architect recommend?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A managed identity is like a badge that Azure issues and renews automatically — the resource proves who it is without carrying a password. Option C is correct because a system-assigned managed identity eliminates the need to store any secret; Azure manages the credential lifecycle entirely.
Full explanation below image
Full Explanation
Managed identities are the preferred credential strategy for Azure-to-Azure communication when no human is in the loop. When you enable a system-assigned managed identity on an Azure resource (such as the Azure Logic Apps or Power Automate environment that runs the flows), Azure creates a corresponding service principal in Entra ID and automatically rotates its credentials. You then assign Azure RBAC roles — for example, 'Storage Blob Data Reader' and 'SQL DB Contributor' — to that managed identity, and the resource authenticates to those services without any stored secret.
Option C is correct and directly satisfies the security team's requirement: no client secrets, no certificates in application settings.
Option A is wrong. While storing a secret in Key Vault is better than plain-text environment variables, it still requires the agent to possess a credential (the secret) and adds a Key Vault retrieval dependency. The security mandate explicitly prohibits stored secrets of any kind in application settings.
Option B is wrong. User-delegated tokens tie the agent's permissions to a human account, which violates the principle of least privilege for unattended workloads. If that account's password changes or the account is disabled, the agent breaks. User accounts are also subject to MFA policies that unattended processes cannot satisfy.
Option D is wrong. Copilot Studio's configuration panel does not support storing Entra ID certificates directly, and this approach still requires managing a certificate lifecycle — which is precisely what managed identities eliminate.
Exam tip: When a question mentions 'unattended,' 'scheduled,' or 'no secrets in configuration,' the answer almost always involves managed identities. Distinguish between system-assigned (tied to one resource, deleted with it) and user-assigned (portable, shared across resources); system-assigned is the simpler choice for single-resource scenarios.