A multi-agent system previously used one shared service principal with broad access to Key Vault, SQL, and Storage for every agent. Security mandates Zero Trust with lateral movement prevention. What identity design should you implement?
Select an answer to reveal the explanation.
Short Explanation
Answer D. Zero Trust multi-agent design needs per-agent identity scoping, lateral movement prevention, and least-privilege RBAC/network boundaries. Shared superuser principals maximize blast radius. Passwords in prompts and Global Admin for agents are severe anti-patterns.
Full Explanation
Correct answer: D. Security skills include resource access via identity-based access, network boundaries, access control policies, and RBAC, plus Zero Trust multi-agent identity scoping. Assign distinct managed identities to orchestrator vs specialists; grant only the tools/data each needs; prefer private endpoints.
A is incorrect: shared broad credentials enable lateral movement after any single agent compromise.
B is incorrect: secrets belong in Key Vault (or equivalent), never in prompts.
C is incorrect: directory Global Administrator is vastly excessive for agent workloads.
Map identities to compliance controls for regulated deployments.