Yes. Azure OpenAI accepts Entra ID bearer tokens in place of the api-key header. You can do this today by consuming the REST API yourself or by adapting a copy of the connector.

1. Azure: register an app in Entra ID and create a certificate or client secret. On the Azure OpenAI resource (IAM), assign it the Cognitive Services OpenAI User role.
2. Token: send POST https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token with grant_type=client_credentials, client_id, client_secret, and scope=https://cognitiveservices.azure.com/.default
3. Call: send Authorization: Bearer {access_token} instead of api-key.
4. ODC side:
   • Keep the tenant and client IDs in settings, and the secret in a secret setting.
   • Wrap the token call in a server action that caches the token (about 1 hour) and refreshes it shortly before expires_in.
   • Add the header in the consumed API’s OnBeforeRequest.

Managed identity isn’t an option here, because the ODC runtime isn’t an Azure resource you control, so client credentials is the way. Most of the security gain comes from short-lived tokens, RBAC, and being able to disable key-based auth on the resource (disableLocalAuth).