I could see the following Recommendations in Microsoft Defender for Cloud

Below is the definition of the Service Account

apiVersion: v1
kind: ServiceAccount
metadata:
  name: workload-identity-sa
  namespace: ...
    ....
  managedFields:
    - manager: HashiCorp
      operation: Update
      apiVersion: v1
      time: '2024-01-29T17:57:49Z'
      fieldsType: FieldsV1
      fieldsV1:
        ....
  selfLink: ....
automountServiceAccountToken: true

and POD definition is

apiVersion: v1
kind: Pod
metadata:
  name: ..
  labels:
    app: ..
  ownerReferences:
    ...
  managedFields:
    - manager: ...
          .....
          f:automountServiceAccountToken: {}
          ....
spec:
  ...
  containers:
    - name: ..
      image: >-
        ..
      ports:
        - name: http
          containerPort: 8080
          protocol: TCP
  ....
  restartPolicy: Always
  terminationGracePeriodSeconds: 60
  dnsPolicy: ClusterFirst
  serviceAccountName: default
  serviceAccount: default
  automountServiceAccountToken: true
  ....

as per the recommendation, automountServiceAccountToken should be set to false.

However, these PODs uses the service account to pull the secrets from Azure Key vault(s) using external-secrets(using Federated Identity) as well as adds the relevant entries in the DNS using external-dns. These PODs also reads the values from Kubernetes config maps and secrets.

would there be an issue with setting automountServiceAccountToken to false? How to address this issue?