PRODUCTION SCENARIO
A Python Foundry client uses a key embedded in the script. It will run on an Azure service that supports managed identity, and the team wants to stop handling a long-lived key at all.
Which authentication change fits?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Use DefaultAzureCredential and assign the identity a role
Managed identities used with Microsoft Entra authentication let an Azure workload authenticate without storing credentials with the application, and the identity still needs a role assignment on the resource. A service principal is also Entra authentication but reintroduces a client secret to manage. A role assignment alone changes nothing while the code still presents a key. Key Vault protects the key well, and the workload still holds a long-lived secret.
Official Source: https://learn.microsoft.com/en-us/azure/ai-services/authentication ↗