What’s the best Azure option for running a PowerShell script daily?

You may not need Key Vault for every API. If the REST APIs are Azure or tenant services that support managed identities, assign the necessary roles or API permissions to the Automation account’s identity and request a token at runtime. For external APIs that require their own client secret, store that secret in Key Vault and allow the managed identity to read it.

Azure Automation is probably the most straightforward choice for this. Create an Automation account, enable its system-assigned managed identity, grant that identity permission to read the required Key Vault secrets, and retrieve them at runtime with the Az PowerShell cmdlets. That keeps the credentials out of the script and works well for a once-daily scheduled run.

A container with a scheduled job is another option if portability and maximum control matter. It can run the script in many environments, but it adds more operational work than Automation or Functions. For a simple daily PowerShell task in an Azure-only organization, I’d start with an Automation runbook and move to a container only if the script outgrows it.

Both Azure Automation and Azure Functions can handle this. Functions are generally a better fit when the script is part of a broader application or needs to integrate with other services, while Automation runbooks are more natural for scheduled administrative PowerShell tasks. Either one can use a managed identity to access Key Vault.