Cross-Tenant Web App Communication: Is Managed Identity + FIC the Recommended Microsoft Best Practice?

I wanted to confirm whether there is a Microsoft-supported way to establish secure communication between two Web Apps hosted in different Entra ID tenants without creating an additional App Registration and without using connection strings, client secrets, certificates, or other stored credentials.

Our current design uses Managed Identity with Federated Identity Credentials (FIC) in a caller-callee pattern, allowing cross-tenant authentication without secrets. Based on our analysis, this appears to be the modern secret less approach recommended for service-to-service communication across tenants.

Could you please confirm whether:

1. Managed Identity + Federated Identity Credential is the recommended Microsoft best-practice architecture for cross-tenant Web App-to-Web App communication?
2. There is any more native or simpler Microsoft-supported alternative that does not require:
   • additional App Registrations,
     • client secrets or certificates,
       • connection strings, or
         • other long-lived credentials.

Our goal is to achieve secure cross-tenant communication using the least operational overhead while remaining fully aligned with Microsoft-supported patterns.