Assign least-privilege Azure roles, not broad contributor rights
Give workloads and people the narrow Azure role they need instead of defaulting to Contributor.
Security
Separate prompts from authorization
Do not let prompt instructions decide what data or actions a user is allowed to access.
Use managed identity before connection strings
Prefer Azure-managed identities over long-lived secrets in deployed applications.