How to programmatically authenticate to AAD when using the SPO ps module

Hello. I'm an AAD admin and a dev needs a script to authenticate to AAD in order to access/modify the contents of document libraries. The script will run multiple times per day on a daily basis. Their preference is to hard code a service account in the script, but I'm not allowing that option.

What is the preferred method?

Note: I have enabled MFA, several CA policies, Risky Sign-ins/Users, etc.

Any help is appreciated.