A security engineer at a company using Azure OpenAI for document analysis needs to ensure that the application properly handles authentication token expiration without service disruption. The application uses a managed identity. Which Azure SDK pattern implements proper token lifecycle management?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — use DefaultAzureCredential or ManagedIdentityCredential because they cache tokens and proactively renew them before expiration. That keeps your Azure OpenAI calls from breaking when tokens expire.
Full Explanation
The correct pattern is using DefaultAzureCredential or ManagedIdentityCredential because the Azure Identity SDK's implementations include built-in token caching and proactive renewal: they cache acquired tokens and automatically obtain new tokens before expiration (typically renewing when the token has 5 minutes remaining), eliminating service disruptions due to token expiration. Caching the Entra ID token at application startup and restarting the application every hour to refresh it is incorrect because it is fragile, causes service disruptions at restart, and does not handle token expiration gracefully mid-operation. Setting the Azure OpenAI token lifetime to 24 hours using Conditional Access token lifetime policies is incorrect because Azure OpenAI calls use short-lived OAuth 2.0 access tokens (typically 1 hour); Conditional Access token lifetime policies affect session/refresh tokens, not the access token lifetime for service-to-service calls. Storing the token in Azure Key Vault and refreshing it daily via an Azure Function is incorrect because storing tokens in Key Vault requires custom renewal logic and does not provide the seamless automatic renewal that the Azure Identity SDK provides natively.