Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn documentation ("Implement app registration and authentication with Microsoft Entra ID") , when configuring app registrations and securing non-interactive service applications (like scheduled tasks), two key elements must be addressed - secure authentication and conditional access enforcement.
Step 1: Secure App Access from the Corporate Network To ensure App1 is accessible only from the corporate network, you must configure a Conditional Access policy in Microsoft Entra ID. Conditional Access policies allow you to restrict access to applications based on conditions such as:
* User or workload identity
* Location (e.g., trusted IP ranges or corporate networks)
* Device compliance and sign-in risk
As Microsoft documentation states:
"Conditional Access policies can restrict access to specific applications based on location, risk, or device status. Use named locations to allow access only from your trusted network." Therefore, a Conditional Access policy is required to meet the first requirement.
Step 2: Secure Authentication for Non-Interactive Tasks For non-interactive scheduled tasks running on an on- premises server (Server1) that need to authenticate to App1 using application permissions, credentials must be securely stored. Storing plain-text secrets (like passwords or client secrets) violates security best practices.
Microsoft recommends using certificates for application authentication because certificates are securely stored and provide higher security than secrets.
From the SC-300 material and Microsoft Learn:
"When registering applications that use non-interactive authentication, use a certificate-based credential instead of a client secret. Certificates are more secure and meet compliance requirements for secure app authentication." This approach also ensures that Server1's scheduled tasks can authenticate silently using the private key of the certificate.