My Azure Automation Runbook uses a stored credential to get a list of new groups, need an alternative that does not use stored credentials - powershell

Question

I have a requirement to disable external sharing on SPOnline sites associated with new Groups (e.g., MS Teams, Planner, etc.). When an Office 365 user provisions a new Team, Planner, or Group an SPOnline site is provisioned in the background to store files for the associated Group. Be default, this "background" SPOnline site allows external sharing of content.
I have created an Azure Automation Runbook that creates a session to Exchange Online using a Stored Credential. I then get a list of the groups created in the past day.
$groups = Get-UnifiedGroup -Filter "WhenCreated -gt '$dt'"
With the list of Groups, I then iterate through them, connect to SPOnline with an AppId and AppSecret and disable sharing.
Connect-PnPOnline -AppId $appId -AppSecret $appSecret -Url $tenantUrl
$site = Get-PnPTenantSite -Url $group.SharePointSiteUrl
Write-Output "Sharing Capability: " $site.SharingCapability
if($site.SharingCapability -ne "Disabled")
{
#Set-PnPTenantSite -Url $site.Url -Sharing Disabled
Write-Output "Disabling external sharing"
}
else
{
Write-Output "External sharing already disabled"
}
My problem is that our production environment uses a PCS system to manage passwords for accounts. This would require more scripting to access the PCS, checkout the password, update the stored credential then do the work that I want to do.
I am able to get the list of Groups directly from Azure AD but the returned objects do not have the WhenCreated and SharePointSiteURL properties. Without these two pieces of information, I am not able to limit my script to the past day nor change the setting in SharePoint.
My goal is to explore any alternative that allow me to get the list of new Groups and the associated SPOnline site URL without using a stored credential in Azure Automation. Any ideas?
Thank you for your time.

Answer 1

Generally you only have 4 options:
hardcode credentials
use variables + certificates (you can make them secure string, so they are encrypted)
use run as account (allows use of certificates)
use credentials + certificates (pretty much the same as variables)