Running on-prem script against 365 without storing plaintext creds

Looking to run a script on an on-prem server to collect audit logs from Exchange online without storing credentials in the script.

Was wondering what the current best practice for this is, or if anyone knows how to do it? Have stumbled across Azure automation, but not sure that will be able to run from on-prem or not and my google-fu isn’t conclusive.

Has anyone done this and could point me in the right direction? One of our local PowerBI guys has been using his own AD user account at the moment and that’s clearly BAD.