A logistics firm runs a deployment job on a self-hosted agent VM, authenticating with a service principal whose client secret expires every few months. Lapses have caused outages when nobody noticed the expiry. The Azure team wants to eliminate the recurring manual secret handling. What change addresses the root problem best?
Show answer and explanation
Answer: D
A managed identity is an identity that Azure creates and manages on behalf of a resource such as a virtual machine. The workload requests tokens from the platform, so no client secret needs to be stored, rotated or allowed to expire. This removes the root cause rather than managing it. Where a service principal is unavoidable, its secret should live in Key Vault with a rotation process. Long expiry increases exposure, sharing one secret widens the blast radius, and shared password managers spread credentials to people who do not need them.
Why the other options are wrong
- A. Extending expiry only postpones the failure and leaves a leaked secret valid for much longer. The scenario is about removing recurring manual handling, and a ten-year secret works against sound credential hygiene.
- B. Sharing the secret through a password manager spreads a credential to people who do not need it and makes it harder to audit or revoke. It does not reduce the handling burden in a secure way.
- C. Reusing one secret across service principals means a single leak compromises every workload, and rotation affects all of them at once. This worsens the blast radius rather than simplifying the security model.