An organization installed a new application server for IP phones. An automated process fetched user credentials from the Active Directory server, and the application will have access to on- premises…

Aligning access control policies is an important governance task but does not address the immediate data-in-transit risk introduced by the active automated credential transfer process.

The automated credential fetch from Active Directory creates an active data-in-transit exposure - if the channel is unencrypted or poorly secured, an attacker can intercept credentials via a man-in-the-middle or sniffing attack. Because the application server has access to both on-premises and cloud services, stolen credentials would grant extremely broad access, making this the highest-priority threat to address before the server goes into production.

Default accounts are a valid new-server concern but are not the specific threat introduced by the automated credential fetching scenario described in the question.

Data exposure from backups is a valid long-term concern but is not directly introduced or made more urgent by the automated credential transfer described.