An organization's Azure OpenAI deployment is experiencing intermittent authentication failures from a legitimate application. The security team suspects the issue is caused by the application's Azure AD token expiring during long-running operations. Which application authentication best practice prevents this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Microsoft Authentication Library (MSAL) provides built-in token cache management and proactive token refresh. Applications should use MSAL's AcquireTokenSilent method, which automatically uses the cached refresh token to obtain a new access token before the current one expires, preventing authentication interruptions during long-running operations.
Full explanation below image
Full Explanation
B is correct because the Microsoft Authentication Library (MSAL) provides built-in token cache management and proactive token refresh. Applications should use MSAL's AcquireTokenSilent method, which automatically uses the cached refresh token to obtain a new access token before the current one expires, preventing authentication interruptions during long-running operations. This is the recommended pattern for resilient service principal authentication to Azure AI services. A is wrong because modifying Entra ID token lifetime policies is generally discouraged for security reasons (longer-lived tokens increase the window for token misuse after compromise); the recommended approach is proactive token refresh. C is wrong because falling back to API keys reintroduces credential management complexity and is a security regression from managed identity or service principal token-based authentication. D is wrong because Conditional Access session controls apply to interactive user sign-in sessions, not to service principal token lifetimes—service principals use access tokens with standard lifetimes governed by Entra ID configuration.