A platform team needs an identity for an unattended deployment script that will read and write resources in an Azure subscription. The identity must not be tied to a person and must be able to hold its own credentials. Which identity type should the team create?
Show answer and explanation
Answer: C
An app registration creates a definition in Microsoft Entra ID, and its service principal is the local object that actually authenticates and is authorised. The team can attach a client secret or, preferably, a certificate, then grant the service principal an RBAC role at the narrowest scope that the script needs. Because no human owns the credential, rotation can be automated and revoking access is a single operation on the service principal rather than on a person's account. When the script runs inside Azure, a managed identity removes the need to store any credential at all.
Why the other options are wrong
- A. A member user account represents a person and is designed for interactive sign-in, with password policies and MFA prompts that unattended automation cannot satisfy cleanly. Sharing a person's account across scripts also destroys the audit trail because activity is attributed to that individual.
- B. A guest account is for external collaboration and is authenticated by the partner's own identity provider. It is not intended to own application credentials or to be the security principal for internal automation.
- D. A Microsoft 365 group is a collaboration container for people, not an identity that can present credentials and receive a token. It can be granted permissions for its members, but it cannot sign in on behalf of a script.
Exam tip. App registration is the definition; the service principal is the identity that gets the role assignment.