Pinecrest Energy runs a Copilot Studio agent that generates nightly compliance reports by reading data from Azure Data Lake Storage Gen2 and writing results to a SharePoint document library. The agent runs on a schedule with no user interaction. A junior developer suggests authenticating the agent's Power Automate flows using a shared service account (a licensed user in Entra ID) with delegated OAuth tokens. The architect disagrees. Which is the most compelling reason to prefer a service principal over a user-delegated token in this scenario?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Linking a nightly compliance agent to a user account is like building a factory that stops when one person calls in sick. Option B is correct — service principals are independent of any human lifecycle event (password reset, license removal, account disable), making them the operationally stable choice for unattended workloads.
Full explanation below image
Full Explanation
For unattended, scheduled agents, the fundamental problem with user-delegated tokens is operational fragility tied to the human account lifecycle. If the shared service account's password is rotated, the stored OAuth refresh token is invalidated and the flow breaks immediately. If the account is disabled for any reason (compliance review, offboarding error, license cost savings), all dependent flows fail. If the Microsoft 365 license is removed, the account cannot authenticate. These are real-world incidents that occur regularly in enterprise environments.
Option B is correct because it identifies the core operational superiority of service principals: they exist as application identities in Entra ID, independent of any individual user's lifecycle. Their credentials (client secrets or certificates) are managed separately and their continuity is not affected by HR events.
Option A is wrong. Service principals themselves do not support MFA — they authenticate using client secrets or certificates, not interactive login flows. In fact, shared service accounts can be configured with conditional access policies. MFA is not the distinguishing factor here.
Option C is wrong. Service principals do not inherently allow broader permissions than users. Both service principals and users are subject to the principle of least privilege and RBAC assignment. A service principal has only the RBAC roles and API permissions explicitly granted to it — it does not have elevated access by default.
Option D is wrong. OAuth access tokens for both service principals and delegated flows typically expire in 60 minutes (not 60 seconds), and both use refresh tokens for renewal. Token expiry is not meaningfully different between the two approaches — Power Automate handles token refresh transparently in both cases.
Exam tip: The key distinction on the exam is operational stability vs. lifecycle risk. Unattended = service principal or managed identity. Interactive/on-behalf-of = user-delegated. Never use shared user accounts for unattended production workloads.