A security engineer is implementing the Microsoft Cloud Security Benchmark (MCSB) controls for an Azure AI platform deployment. The MCSB control 'IM-1: Use centralized identity and authentication system' requires all service-to-service authentication to use Entra ID. A legacy AI service component uses username/password authentication with a local account. Which migration path aligns with the MCSB IM-1 control?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the MCSB IM-1 control specifically requires using Microsoft Entra ID (the centralized identity system) for all authentication, eliminating local accounts and passwords. Migrating to managed identity authentication means the calling service authenticates using its Entra ID identity (no credentials needed) and the target service validates Entra ID tokens, fully aligning with IM-1.
Full explanation below image
Full Explanation
B is correct because the MCSB IM-1 control specifically requires using Microsoft Entra ID (the centralized identity system) for all authentication, eliminating local accounts and passwords. Migrating to managed identity authentication means the calling service authenticates using its Entra ID identity (no credentials needed) and the target service validates Entra ID tokens, fully aligning with IM-1. A is incorrect because storing credentials in Key Vault is a secrets management improvement but does not migrate to Entra ID centralized authentication as required by IM-1; it still uses username/password. C is incorrect because creating an Entra ID service account with a password is still password-based authentication; managed identity (non-secret-based) is the MCSB IM-1 preferred approach. D is incorrect because certificate-based authentication is more secure than passwords but still does not align with the IM-1 requirement for Entra ID centralized identity; managed identity is preferred.