A clerk of courts agent must call Azure resources from Foundry without embedding long-lived secrets in code. What credential approach should they configure?
Select an answer to reveal the explanation.
Short Explanation
You'll stall your courthouse flow if you're waiting on user delegation with keyless user tokens for every background call. Managed identity lets the Foundry workload prove who it is without stuffing secrets into code. It's built for the workload itself, so you don't need to borrow keyless GitHub trust from an outside workflow or swap user tokens through keyless client assertion.
Full Explanation
A clerk-of-courts Foundry agent should use managed identity with keyless credentials so Azure resource calls authenticate without embedding long-lived secrets in code. The approach works because the civic workload receives tokens from Azure AD based on its assigned identity and RBAC roles, avoiding user delegation with keyless user tokens for background calls, federated credentials with keyless GitHub trust tied to an external workflow, and on-behalf-of with keyless client assertion through a client. Keyless credentials reduce rotation toil and shrink the blast radius when staff turn over—critical for courts systems that touch filings and case data.
User delegation with keyless user tokens for the civic AI workload fails because it requires a signed-in user to be present to authenticate, which breaks unattended agent calls to Azure resources and ties courts automation to individual user sessions. Federated credentials with keyless GitHub trust for the civic AI workload fail because they establish trust for a GitHub workflow to obtain Azure tokens, which creates the wrong trust boundary and does not give the Foundry agent itself a workload identity with RBAC. On-behalf-of with keyless client assertion for the civic AI workload fails because it is designed for a middle tier acting on behalf of an already authenticated user, so it still depends on a user token even with a keyless client assertion and cannot provide unattended keyless authentication for the agent itself.
Exam caveat: managed identity still requires least-privilege role assignments and network controls; an over-privileged identity is keyless but not safe. Operational check: remove static keys from courts connectors, assign a dedicated managed identity with only required data-plane roles, verify token-based calls succeed in staging, and confirm secret scanners no longer find API keys in the agent’s deployment artifacts.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.