If you really have a need for DAP, you have make sure that these permissions are not abused e.g. with account separation, @azuread PIM, and additional alerting when these credentials are actively used.