I have a windows service app which is unattended and I am looking to implement Azure certificate based authentication using Key vault. from this git hub example its pretty straight forward, you use a app registration and provide the key vault path for the certificate to authenticate & it works !.

the problem here is, if someone gains access to these settings they can authenticate easily, because there is nothing that would prevent a attacker to stop.

using certificate based authentication without keyvault seems secure because, a attacker has to obtain that even if the app is breached. but keyvault certificate based authentication just makes it too easy.

is this secure ?

thanks.