MicrosoftWe do have service accounts in Entra which access mailboxes through IMAP via MS Graph or using EWS. Those accounts require delegated access, because the apllication works this way. Those service accounts are secured through CA in the way that they only could login from a specific location, but are not required to use MFA.
You suppose to move this to workload identities. But from the description that doesn't sound like the delegated access scenario is compatible with workload identities.
What are we supposed to do with such workloads? I mean, that LOB stuff, where we don't have too much control of.
