A solution architect is planning authentication for a Copilot Studio agent that needs to call an Azure Function. The team wants to avoid storing credentials or rotating secrets manually. Which authentication approach best meets this requirement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Managed identities eliminate the secret rotation headache — the platform handles credentials automatically. For Power Platform calling Azure, a managed identity on the environment removes the need to store or rotate any secrets. Answer: C.
Full explanation below image
Full Explanation
Managed identities provide automatic credential management for Azure-hosted services. When the Power Platform environment has a system-assigned managed identity, the platform can authenticate to Azure resources (like Azure Functions, Azure Key Vault, or Azure AI Search) using the identity directly — no client secrets, no certificate files, no rotation schedules.
Option C is correct. A system-assigned managed identity tied to the Power Platform environment allows connectors and flows to call Azure resources authenticated as that identity. The Azure resource (Azure Function in this case) is configured to grant the managed identity access via Azure RBAC. There are no credentials to store, no expiry dates to track, and no secrets to rotate.
Option A is incorrect. While a service principal with a client secret works technically, it introduces a credentials management burden. Secrets expire, and when they do, the agent breaks. Storing secrets in environment variables also means they appear in plain text in the Power Platform admin center.
Option B is incorrect as stated. The managed identity on the Azure Function's hosting resource (App Service Plan) allows the function to call OTHER Azure resources — it does not help the Copilot Studio agent authenticate TO the Azure Function. The identity needs to be on the calling side (Power Platform), not the called side.
Option D is incorrect. Making an Azure Function anonymous and relying on IP allowlisting is a weak security posture. Power Platform uses dynamic, shared IP ranges that are not practical for strict allowlisting, and anonymous endpoints have no authentication layer if the IP control fails.