Your pipeline has no MFA. Your app cannot approve anything. For people you constrain who gets in, and you have plenty of tools to do it with. For a workload there is nobody to ask, so all you have left is what the identity is, what it can reach, how long its credential lives, and whether it needs a credential at all.

Let's walk through the options. Managed identity or federated credential. System-assigned or user-assigned. Contributor or Owner, and at what scope should that land? Least privilege sounds great, but it is not always the most practical answer, or even the most secure one, and I will show you where it falls apart.

This is a part of Azure access that is ignored far to often. You will leave with a decision tree and practical tips to improve. The more secure option might actually be easier to maintain