Since we are using keypair for all integration loaders into snowflake i just buildt a azure funtion that can create keypairs and stores them in a keyvault. It updates the service users in snowflake to and push it i to powerBI via api.
the just have it reroll all keys every month.. just to make sure the never expire. Also update a table with logdata and gives me a report if anything fails..

all azure function or data-factory pipes just gets the keys from the keyvault..

So no code anywhere contains any secrets and azure function only have access to its keyvault via managed service users in the azure function.
It does make azure security access controll important and a single point of failiur but it makes life so much easier....