It depends on where you host the application. If it's in Azure, the best approach is to use managed identity, since it eliminates the need for clientId and clientSecrets. When it's outside of Azure and you use a deployment pipeline like Github Actions, I'd store it in the Github Secrets for accessing it during the deployment. Or last option, when it's a manual deployment on a server you could store it in the environment variable on the system to inject them securly during runtime.