What’s the best Azure option for running a PowerShell script daily?

Both Azure Automation and Azure Functions can handle this. Functions tend to be more developer-oriented and are useful when the code needs to integrate with other services or respond to events. Automation runbooks are usually simpler for scheduled administrative scripts.

A container with a scheduled job is another flexible option, but it adds operational overhead. Containers are portable and powerful, though you’ll need to manage the runtime, scheduling, monitoring, and authentication yourself. For a once-daily PowerShell task, that is probably more complexity than necessary unless you already use containers.

Azure Automation is probably the most straightforward choice for a PowerShell script that just needs to run on a schedule. Enable the Automation account’s system-assigned managed identity, grant it permission to read the required secrets from Key Vault, and retrieve them at runtime with Get-AzKeyVaultSecret.

You may not need Key Vault for every API. For Azure resources and Microsoft Graph, the Automation account’s managed identity can often be granted the necessary roles or API permissions directly. The script can then authenticate with managed identity and obtain tokens without managing a separate client secret. For external APIs that require credentials, store those secrets in Key Vault and authorize the managed identity to read them.