Thank you @Sridevi, for posting the article from MS. This issue has become critical for us because MS will begin enforce MFA on all Entra Account access to Azure as of the end of this month (September, 2025). As far as I can tell, the best solution appears to be either a Service Principal or a User Assigned Managed Identity. Sadly, I can't figure out how to enforce user entitlements with either choice.