diff --git a/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen.go b/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen.go
index d76f3e3faaa..689bbf133bb 100644
--- a/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen.go
+++ b/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen.go
@@ -540,9 +540,6 @@ type ManagedClusterProperties_AutoScalerProfile_STATUS_ARM struct {
 type ManagedClusterServicePrincipalProfile_STATUS_ARM struct {
 	// ClientId: The ID for the service principal.
 	ClientId *string `json:"clientId,omitempty"`
-
-	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
 }
 
 type ManagedClusterSKU_Name_STATUS string
diff --git a/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen_test.go b/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen_test.go
index bb1a22f3be7..79e7f3ba4dd 100644
--- a/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen_test.go
+++ b/v2/api/containerservice/v1api20210501/managed_cluster_status_arm_types_gen_test.go
@@ -1290,7 +1290,6 @@ func ManagedClusterServicePrincipalProfile_STATUS_ARMGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterWindowsProfile_STATUS_ARM_WhenSerializedToJson_DeserializesAsEqual(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20210501/managed_cluster_types_gen.go b/v2/api/containerservice/v1api20210501/managed_cluster_types_gen.go
index 762f04a087f..ca5a319cdb2 100644
--- a/v2/api/containerservice/v1api20210501/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1api20210501/managed_cluster_types_gen.go
@@ -8821,7 +8821,7 @@ type ManagedClusterServicePrincipalProfile struct {
 	ClientId *string `json:"clientId,omitempty"`
 
 	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
+	Secret *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 var _ genruntime.ARMTransformer = &ManagedClusterServicePrincipalProfile{}
@@ -8841,7 +8841,11 @@ func (profile *ManagedClusterServicePrincipalProfile) ConvertToARM(resolved genr
 
 	// Set property ‘Secret’:
 	if profile.Secret != nil {
-		secret := *profile.Secret
+		secretSecret, err := resolved.ResolvedSecrets.Lookup(*profile.Secret)
+		if err != nil {
+			return nil, errors.Wrap(err, "looking up secret for property Secret")
+		}
+		secret := secretSecret
 		result.Secret = &secret
 	}
 	return result, nil
@@ -8865,11 +8869,7 @@ func (profile *ManagedClusterServicePrincipalProfile) PopulateFromARM(owner genr
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
+	// no assignment for property ‘Secret’
 
 	// No error
 	return nil
@@ -8882,7 +8882,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_From_Mana
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
 	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
+	if source.Secret != nil {
+		secret := source.Secret.Copy()
+		profile.Secret = &secret
+	} else {
+		profile.Secret = nil
+	}
 
 	// No error
 	return nil
@@ -8897,7 +8902,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
 	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
+	if profile.Secret != nil {
+		secret := profile.Secret.Copy()
+		destination.Secret = &secret
+	} else {
+		destination.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -8914,9 +8924,6 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	// ClientId: The ID for the service principal.
 	ClientId *string `json:"clientId,omitempty"`
-
-	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
 }
 
 var _ genruntime.FromARMConverter = &ManagedClusterServicePrincipalProfile_STATUS{}
@@ -8939,12 +8946,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) PopulateFromARM(own
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
-
 	// No error
 	return nil
 }
@@ -8955,9 +8956,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_Fr
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// No error
 	return nil
 }
@@ -8970,9 +8968,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_To
 	// ClientId
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
-	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		destination.PropertyBag = propertyBag
diff --git a/v2/api/containerservice/v1api20210501/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1api20210501/managed_cluster_types_gen_test.go
index 91b081f6237..dc1075d0971 100644
--- a/v2/api/containerservice/v1api20210501/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1api20210501/managed_cluster_types_gen_test.go
@@ -3464,7 +3464,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
@@ -3568,7 +3567,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20210501/structure.txt b/v2/api/containerservice/v1api20210501/structure.txt
index 9c7e38f73ea..15e2689c228 100644
--- a/v2/api/containerservice/v1api20210501/structure.txt
+++ b/v2/api/containerservice/v1api20210501/structure.txt
@@ -264,7 +264,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20210501
 │   │   │   └── Type: *string
 │   │   ├── ServicePrincipalProfile: *Object (2 properties)
 │   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (2 properties)
 │   │   │   ├── Name: *Enum (1 value)
 │   │   │   │   └── "Basic"
@@ -554,9 +554,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20210501
 │       │   ├── RequiredMembers: string[]
 │       │   └── Type: *string
 │       ├── ProvisioningState: *string
-│       ├── ServicePrincipalProfile: *Object (2 properties)
-│       │   ├── ClientId: *string
-│       │   └── Secret: *string
+│       ├── ServicePrincipalProfile: *Object (1 property)
+│       │   └── ClientId: *string
 │       ├── Sku: *Object (2 properties)
 │       │   ├── Name: *Enum (1 value)
 │       │   │   └── "Basic"
@@ -847,9 +846,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20210501
 │   │   │   ├── RequiredMembers: string[]
 │   │   │   └── Type: *string
 │   │   ├── ProvisioningState: *string
-│   │   ├── ServicePrincipalProfile: *Object (2 properties)
-│   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   ├── ServicePrincipalProfile: *Object (1 property)
+│   │   │   └── ClientId: *string
 │   │   └── WindowsProfile: *Object (4 properties)
 │   │       ├── AdminPassword: *string
 │   │       ├── AdminUsername: *string
diff --git a/v2/api/containerservice/v1api20210501/zz_generated.deepcopy.go b/v2/api/containerservice/v1api20210501/zz_generated.deepcopy.go
index c255ce90f70..18ef823db82 100644
--- a/v2/api/containerservice/v1api20210501/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1api20210501/zz_generated.deepcopy.go
@@ -5179,7 +5179,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -5227,11 +5227,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
@@ -5252,11 +5247,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS_ARM) DeepCopyInto(out *Ma
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS_ARM.
diff --git a/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen.go b/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen.go
index 49dc8d5d542..81ca40350d7 100644
--- a/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen.go
@@ -6070,9 +6070,9 @@ func (profile *ManagedClusterProperties_AutoScalerProfile_STATUS) AssignProperti
 // Storage version of v1api20210501.ManagedClusterServicePrincipalProfile
 // Information about a service principal identity for the cluster to use for manipulating Azure APIs.
 type ManagedClusterServicePrincipalProfile struct {
-	ClientId    *string                `json:"clientId,omitempty"`
-	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
+	ClientId    *string                     `json:"clientId,omitempty"`
+	PropertyBag genruntime.PropertyBag      `json:"$propertyBag,omitempty"`
+	Secret      *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 // AssignProperties_From_ManagedClusterServicePrincipalProfile populates our ManagedClusterServicePrincipalProfile from the provided source ManagedClusterServicePrincipalProfile
@@ -6084,7 +6084,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_From_Mana
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
 	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
+	if source.Secret != nil {
+		secret := source.Secret.Copy()
+		profile.Secret = &secret
+	} else {
+		profile.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -6115,7 +6120,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
 	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
+	if profile.Secret != nil {
+		secret := profile.Secret.Copy()
+		destination.Secret = &secret
+	} else {
+		destination.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -6142,7 +6152,6 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	ClientId    *string                `json:"clientId,omitempty"`
 	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
 }
 
 // AssignProperties_From_ManagedClusterServicePrincipalProfile_STATUS populates our ManagedClusterServicePrincipalProfile_STATUS from the provided source ManagedClusterServicePrincipalProfile_STATUS
@@ -6153,9 +6162,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_Fr
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		profile.PropertyBag = propertyBag
@@ -6184,9 +6190,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_To
 	// ClientId
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
-	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		destination.PropertyBag = propertyBag
diff --git a/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen_test.go
index f7d961e9946..d68e9968410 100644
--- a/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1api20210501storage/managed_cluster_types_gen_test.go
@@ -3434,7 +3434,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
@@ -3538,7 +3537,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20210501storage/structure.txt b/v2/api/containerservice/v1api20210501storage/structure.txt
index 47f061dc8d9..e490faa5fe0 100644
--- a/v2/api/containerservice/v1api20210501storage/structure.txt
+++ b/v2/api/containerservice/v1api20210501storage/structure.txt
@@ -241,7 +241,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20210501sto
 │   │   ├── ServicePrincipalProfile: *Object (3 properties)
 │   │   │   ├── ClientId: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (3 properties)
 │   │   │   ├── Name: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
@@ -515,10 +515,9 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20210501sto
 │       │   └── Type: *string
 │       ├── PropertyBag: genruntime.PropertyBag
 │       ├── ProvisioningState: *string
-│       ├── ServicePrincipalProfile: *Object (3 properties)
+│       ├── ServicePrincipalProfile: *Object (2 properties)
 │       │   ├── ClientId: *string
-│       │   ├── PropertyBag: genruntime.PropertyBag
-│       │   └── Secret: *string
+│       │   └── PropertyBag: genruntime.PropertyBag
 │       ├── Sku: *Object (3 properties)
 │       │   ├── Name: *string
 │       │   ├── PropertyBag: genruntime.PropertyBag
diff --git a/v2/api/containerservice/v1api20210501storage/zz_generated.deepcopy.go b/v2/api/containerservice/v1api20210501storage/zz_generated.deepcopy.go
index d469e7119b1..c1c7dfadac7 100644
--- a/v2/api/containerservice/v1api20210501storage/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1api20210501storage/zz_generated.deepcopy.go
@@ -2708,7 +2708,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -2738,11 +2738,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 			(*out)[key] = val
 		}
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
diff --git a/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen.go b/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen.go
index f629b7f6f5b..ee3084a81a7 100644
--- a/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen.go
+++ b/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen.go
@@ -676,9 +676,6 @@ type ManagedClusterSecurityProfile_STATUS_ARM struct {
 type ManagedClusterServicePrincipalProfile_STATUS_ARM struct {
 	// ClientId: The ID for the service principal.
 	ClientId *string `json:"clientId,omitempty"`
-
-	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
 }
 
 type ManagedClusterSKU_Name_STATUS string
diff --git a/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen_test.go b/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen_test.go
index 7580bcf8880..15e53f9a12e 100644
--- a/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen_test.go
+++ b/v2/api/containerservice/v1api20230201/managed_cluster_status_arm_types_gen_test.go
@@ -1579,7 +1579,6 @@ func ManagedClusterServicePrincipalProfile_STATUS_ARMGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterStorageProfile_STATUS_ARM_WhenSerializedToJson_DeserializesAsEqual(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20230201/managed_cluster_types_gen.go b/v2/api/containerservice/v1api20230201/managed_cluster_types_gen.go
index 0b01a83b9ab..f7cf5619c25 100644
--- a/v2/api/containerservice/v1api20230201/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1api20230201/managed_cluster_types_gen.go
@@ -12096,7 +12096,7 @@ type ManagedClusterServicePrincipalProfile struct {
 	ClientId *string `json:"clientId,omitempty"`
 
 	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
+	Secret *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 var _ genruntime.ARMTransformer = &ManagedClusterServicePrincipalProfile{}
@@ -12116,7 +12116,11 @@ func (profile *ManagedClusterServicePrincipalProfile) ConvertToARM(resolved genr
 
 	// Set property ‘Secret’:
 	if profile.Secret != nil {
-		secret := *profile.Secret
+		secretSecret, err := resolved.ResolvedSecrets.Lookup(*profile.Secret)
+		if err != nil {
+			return nil, errors.Wrap(err, "looking up secret for property Secret")
+		}
+		secret := secretSecret
 		result.Secret = &secret
 	}
 	return result, nil
@@ -12140,11 +12144,7 @@ func (profile *ManagedClusterServicePrincipalProfile) PopulateFromARM(owner genr
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
+	// no assignment for property ‘Secret’
 
 	// No error
 	return nil
@@ -12157,7 +12157,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_From_Mana
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
 	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
+	if source.Secret != nil {
+		secret := source.Secret.Copy()
+		profile.Secret = &secret
+	} else {
+		profile.Secret = nil
+	}
 
 	// No error
 	return nil
@@ -12172,7 +12177,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
 	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
+	if profile.Secret != nil {
+		secret := profile.Secret.Copy()
+		destination.Secret = &secret
+	} else {
+		destination.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -12191,9 +12201,6 @@ func (profile *ManagedClusterServicePrincipalProfile) Initialize_From_ManagedClu
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// No error
 	return nil
 }
@@ -12202,9 +12209,6 @@ func (profile *ManagedClusterServicePrincipalProfile) Initialize_From_ManagedClu
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	// ClientId: The ID for the service principal.
 	ClientId *string `json:"clientId,omitempty"`
-
-	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
 }
 
 var _ genruntime.FromARMConverter = &ManagedClusterServicePrincipalProfile_STATUS{}
@@ -12227,12 +12231,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) PopulateFromARM(own
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
-
 	// No error
 	return nil
 }
@@ -12243,9 +12241,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_Fr
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// No error
 	return nil
 }
@@ -12258,9 +12253,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_To
 	// ClientId
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
-	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		destination.PropertyBag = propertyBag
diff --git a/v2/api/containerservice/v1api20230201/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1api20230201/managed_cluster_types_gen_test.go
index 7148f1ddecd..0d4957fab19 100644
--- a/v2/api/containerservice/v1api20230201/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1api20230201/managed_cluster_types_gen_test.go
@@ -4140,7 +4140,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
@@ -4244,7 +4243,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20230201/structure.txt b/v2/api/containerservice/v1api20230201/structure.txt
index 61d711d9c4b..fc20d1f0f0a 100644
--- a/v2/api/containerservice/v1api20230201/structure.txt
+++ b/v2/api/containerservice/v1api20230201/structure.txt
@@ -336,7 +336,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230201
 │   │   │       └── Enabled: *bool
 │   │   ├── ServicePrincipalProfile: *Object (2 properties)
 │   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (2 properties)
 │   │   │   ├── Name: *Enum (1 value)
 │   │   │   │   └── "Base"
@@ -709,9 +709,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230201
 │       │   │   └── IntervalHours: *int
 │       │   └── WorkloadIdentity: *Object (1 property)
 │       │       └── Enabled: *bool
-│       ├── ServicePrincipalProfile: *Object (2 properties)
-│       │   ├── ClientId: *string
-│       │   └── Secret: *string
+│       ├── ServicePrincipalProfile: *Object (1 property)
+│       │   └── ClientId: *string
 │       ├── Sku: *Object (2 properties)
 │       │   ├── Name: *Enum (1 value)
 │       │   │   └── "Base"
@@ -1100,9 +1099,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230201
 │   │   │   │   └── IntervalHours: *int
 │   │   │   └── WorkloadIdentity: *Object (1 property)
 │   │   │       └── Enabled: *bool
-│   │   ├── ServicePrincipalProfile: *Object (2 properties)
-│   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   ├── ServicePrincipalProfile: *Object (1 property)
+│   │   │   └── ClientId: *string
 │   │   ├── StorageProfile: *Object (4 properties)
 │   │   │   ├── BlobCSIDriver: *Object (1 property)
 │   │   │   │   └── Enabled: *bool
diff --git a/v2/api/containerservice/v1api20230201/zz_generated.deepcopy.go b/v2/api/containerservice/v1api20230201/zz_generated.deepcopy.go
index 74faa3d4447..b5c5017a8c6 100644
--- a/v2/api/containerservice/v1api20230201/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1api20230201/zz_generated.deepcopy.go
@@ -6872,7 +6872,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -6920,11 +6920,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
@@ -6945,11 +6940,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS_ARM) DeepCopyInto(out *Ma
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS_ARM.
diff --git a/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen.go b/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen.go
index 97c8904fa0a..2466e8b4767 100644
--- a/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen.go
@@ -714,9 +714,9 @@ type ManagedClusterSecurityProfile_STATUS struct {
 // Storage version of v1api20230201.ManagedClusterServicePrincipalProfile
 // Information about a service principal identity for the cluster to use for manipulating Azure APIs.
 type ManagedClusterServicePrincipalProfile struct {
-	ClientId    *string                `json:"clientId,omitempty"`
-	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
+	ClientId    *string                     `json:"clientId,omitempty"`
+	PropertyBag genruntime.PropertyBag      `json:"$propertyBag,omitempty"`
+	Secret      *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 // Storage version of v1api20230201.ManagedClusterServicePrincipalProfile_STATUS
@@ -724,7 +724,6 @@ type ManagedClusterServicePrincipalProfile struct {
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	ClientId    *string                `json:"clientId,omitempty"`
 	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
 }
 
 // Storage version of v1api20230201.ManagedClusterSKU
diff --git a/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen_test.go
index 12b67b28600..63843c1f11e 100644
--- a/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1api20230201storage/managed_cluster_types_gen_test.go
@@ -2581,7 +2581,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenSerializedToJson_DeserializesAsEqual(t *testing.T) {
@@ -2643,7 +2642,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenSerializedToJson_DeserializesAsEqual(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20230201storage/structure.txt b/v2/api/containerservice/v1api20230201storage/structure.txt
index 340faa75f05..92b591fce2f 100644
--- a/v2/api/containerservice/v1api20230201storage/structure.txt
+++ b/v2/api/containerservice/v1api20230201storage/structure.txt
@@ -301,7 +301,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230201sto
 │   │   ├── ServicePrincipalProfile: *Object (3 properties)
 │   │   │   ├── ClientId: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (3 properties)
 │   │   │   ├── Name: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
@@ -659,10 +659,9 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230201sto
 │       │   └── WorkloadIdentity: *Object (2 properties)
 │       │       ├── Enabled: *bool
 │       │       └── PropertyBag: genruntime.PropertyBag
-│       ├── ServicePrincipalProfile: *Object (3 properties)
+│       ├── ServicePrincipalProfile: *Object (2 properties)
 │       │   ├── ClientId: *string
-│       │   ├── PropertyBag: genruntime.PropertyBag
-│       │   └── Secret: *string
+│       │   └── PropertyBag: genruntime.PropertyBag
 │       ├── Sku: *Object (3 properties)
 │       │   ├── Name: *string
 │       │   ├── PropertyBag: genruntime.PropertyBag
diff --git a/v2/api/containerservice/v1api20230201storage/zz_generated.deepcopy.go b/v2/api/containerservice/v1api20230201storage/zz_generated.deepcopy.go
index 76a0f07ba8f..7ba601fd3e9 100644
--- a/v2/api/containerservice/v1api20230201storage/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1api20230201storage/zz_generated.deepcopy.go
@@ -3679,7 +3679,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -3709,11 +3709,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 			(*out)[key] = val
 		}
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
diff --git a/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen.go b/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen.go
index c66cc72daa3..b53bcee1e5d 100644
--- a/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen.go
+++ b/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen.go
@@ -781,9 +781,6 @@ type ManagedClusterSecurityProfile_STATUS_ARM struct {
 type ManagedClusterServicePrincipalProfile_STATUS_ARM struct {
 	// ClientId: The ID for the service principal.
 	ClientId *string `json:"clientId,omitempty"`
-
-	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
 }
 
 type ManagedClusterSKU_Name_STATUS string
diff --git a/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen_test.go b/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen_test.go
index cc1f4f5604b..e43422c253d 100644
--- a/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen_test.go
+++ b/v2/api/containerservice/v1api20230202preview/managed_cluster_status_arm_types_gen_test.go
@@ -1924,7 +1924,6 @@ func ManagedClusterServicePrincipalProfile_STATUS_ARMGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterStorageProfile_STATUS_ARM_WhenSerializedToJson_DeserializesAsEqual(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen.go b/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen.go
index d0d3a8b70a7..58f7fbd4755 100644
--- a/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen.go
@@ -13147,7 +13147,7 @@ type ManagedClusterServicePrincipalProfile struct {
 	ClientId *string `json:"clientId,omitempty"`
 
 	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
+	Secret *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 var _ genruntime.ARMTransformer = &ManagedClusterServicePrincipalProfile{}
@@ -13167,7 +13167,11 @@ func (profile *ManagedClusterServicePrincipalProfile) ConvertToARM(resolved genr
 
 	// Set property ‘Secret’:
 	if profile.Secret != nil {
-		secret := *profile.Secret
+		secretSecret, err := resolved.ResolvedSecrets.Lookup(*profile.Secret)
+		if err != nil {
+			return nil, errors.Wrap(err, "looking up secret for property Secret")
+		}
+		secret := secretSecret
 		result.Secret = &secret
 	}
 	return result, nil
@@ -13191,11 +13195,7 @@ func (profile *ManagedClusterServicePrincipalProfile) PopulateFromARM(owner genr
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
+	// no assignment for property ‘Secret’
 
 	// No error
 	return nil
@@ -13208,7 +13208,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_From_Mana
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
 	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
+	if source.Secret != nil {
+		secret := source.Secret.Copy()
+		profile.Secret = &secret
+	} else {
+		profile.Secret = nil
+	}
 
 	// No error
 	return nil
@@ -13223,7 +13228,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
 	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
+	if profile.Secret != nil {
+		secret := profile.Secret.Copy()
+		destination.Secret = &secret
+	} else {
+		destination.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -13240,9 +13250,6 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	// ClientId: The ID for the service principal.
 	ClientId *string `json:"clientId,omitempty"`
-
-	// Secret: The secret password associated with the service principal in plain text.
-	Secret *string `json:"secret,omitempty"`
 }
 
 var _ genruntime.FromARMConverter = &ManagedClusterServicePrincipalProfile_STATUS{}
@@ -13265,12 +13272,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) PopulateFromARM(own
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
-
 	// No error
 	return nil
 }
@@ -13281,9 +13282,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_Fr
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// No error
 	return nil
 }
@@ -13296,9 +13294,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_To
 	// ClientId
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
-	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		destination.PropertyBag = propertyBag
diff --git a/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen_test.go
index edc6c2a46e5..9667ceff65a 100644
--- a/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1api20230202preview/managed_cluster_types_gen_test.go
@@ -5209,7 +5209,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
@@ -5313,7 +5312,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20230202preview/structure.txt b/v2/api/containerservice/v1api20230202preview/structure.txt
index e39ad254589..f92a3a39ca0 100644
--- a/v2/api/containerservice/v1api20230202preview/structure.txt
+++ b/v2/api/containerservice/v1api20230202preview/structure.txt
@@ -415,7 +415,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230202pre
 │   │   │       └── "Istio"
 │   │   ├── ServicePrincipalProfile: *Object (2 properties)
 │   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (2 properties)
 │   │   │   ├── Name: *Enum (1 value)
 │   │   │   │   └── "Base"
@@ -883,9 +883,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230202pre
 │       │   └── Mode: *Enum (2 values)
 │       │       ├── "Disabled"
 │       │       └── "Istio"
-│       ├── ServicePrincipalProfile: *Object (2 properties)
-│       │   ├── ClientId: *string
-│       │   └── Secret: *string
+│       ├── ServicePrincipalProfile: *Object (1 property)
+│       │   └── ClientId: *string
 │       ├── Sku: *Object (2 properties)
 │       │   ├── Name: *Enum (1 value)
 │       │   │   └── "Base"
@@ -1369,9 +1368,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230202pre
 │   │   │   └── Mode: *Enum (2 values)
 │   │   │       ├── "Disabled"
 │   │   │       └── "Istio"
-│   │   ├── ServicePrincipalProfile: *Object (2 properties)
-│   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   ├── ServicePrincipalProfile: *Object (1 property)
+│   │   │   └── ClientId: *string
 │   │   ├── StorageProfile: *Object (4 properties)
 │   │   │   ├── BlobCSIDriver: *Object (1 property)
 │   │   │   │   └── Enabled: *bool
diff --git a/v2/api/containerservice/v1api20230202preview/zz_generated.deepcopy.go b/v2/api/containerservice/v1api20230202preview/zz_generated.deepcopy.go
index 7e313fe526e..d443a8c4bfe 100644
--- a/v2/api/containerservice/v1api20230202preview/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1api20230202preview/zz_generated.deepcopy.go
@@ -8665,7 +8665,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -8713,11 +8713,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
@@ -8738,11 +8733,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS_ARM) DeepCopyInto(out *Ma
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS_ARM.
diff --git a/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen.go b/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen.go
index 0a1ddb6ec88..3b2f5c09284 100644
--- a/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen.go
@@ -7383,9 +7383,9 @@ func (profile *ManagedClusterSecurityProfile_STATUS) AssignProperties_To_Managed
 // Storage version of v1api20230202preview.ManagedClusterServicePrincipalProfile
 // Information about a service principal identity for the cluster to use for manipulating Azure APIs.
 type ManagedClusterServicePrincipalProfile struct {
-	ClientId    *string                `json:"clientId,omitempty"`
-	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
+	ClientId    *string                     `json:"clientId,omitempty"`
+	PropertyBag genruntime.PropertyBag      `json:"$propertyBag,omitempty"`
+	Secret      *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 // AssignProperties_From_ManagedClusterServicePrincipalProfile populates our ManagedClusterServicePrincipalProfile from the provided source ManagedClusterServicePrincipalProfile
@@ -7397,7 +7397,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_From_Mana
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
 	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
+	if source.Secret != nil {
+		secret := source.Secret.Copy()
+		profile.Secret = &secret
+	} else {
+		profile.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -7428,7 +7433,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
 	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
+	if profile.Secret != nil {
+		secret := profile.Secret.Copy()
+		destination.Secret = &secret
+	} else {
+		destination.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -7455,7 +7465,6 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	ClientId    *string                `json:"clientId,omitempty"`
 	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
 }
 
 // AssignProperties_From_ManagedClusterServicePrincipalProfile_STATUS populates our ManagedClusterServicePrincipalProfile_STATUS from the provided source ManagedClusterServicePrincipalProfile_STATUS
@@ -7466,9 +7475,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_Fr
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		profile.PropertyBag = propertyBag
@@ -7497,9 +7503,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_To
 	// ClientId
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
-	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		destination.PropertyBag = propertyBag
diff --git a/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen_test.go
index c0defcfc6b8..4fbdec92ef3 100644
--- a/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1api20230202previewstorage/managed_cluster_types_gen_test.go
@@ -4815,7 +4815,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
@@ -4919,7 +4918,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
diff --git a/v2/api/containerservice/v1api20230202previewstorage/structure.txt b/v2/api/containerservice/v1api20230202previewstorage/structure.txt
index 0fc6d46ae5a..f33a26dd59d 100644
--- a/v2/api/containerservice/v1api20230202previewstorage/structure.txt
+++ b/v2/api/containerservice/v1api20230202previewstorage/structure.txt
@@ -366,7 +366,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230202pre
 │   │   ├── ServicePrincipalProfile: *Object (3 properties)
 │   │   │   ├── ClientId: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (3 properties)
 │   │   │   ├── Name: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
@@ -808,10 +808,9 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1api20230202pre
 │       │   │   └── PropertyBag: genruntime.PropertyBag
 │       │   ├── Mode: *string
 │       │   └── PropertyBag: genruntime.PropertyBag
-│       ├── ServicePrincipalProfile: *Object (3 properties)
+│       ├── ServicePrincipalProfile: *Object (2 properties)
 │       │   ├── ClientId: *string
-│       │   ├── PropertyBag: genruntime.PropertyBag
-│       │   └── Secret: *string
+│       │   └── PropertyBag: genruntime.PropertyBag
 │       ├── Sku: *Object (3 properties)
 │       │   ├── Name: *string
 │       │   ├── PropertyBag: genruntime.PropertyBag
diff --git a/v2/api/containerservice/v1api20230202previewstorage/zz_generated.deepcopy.go b/v2/api/containerservice/v1api20230202previewstorage/zz_generated.deepcopy.go
index d09b57a34f5..832640fe4b1 100644
--- a/v2/api/containerservice/v1api20230202previewstorage/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1api20230202previewstorage/zz_generated.deepcopy.go
@@ -4702,7 +4702,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -4732,11 +4732,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 			(*out)[key] = val
 		}
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
diff --git a/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen.go b/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen.go
index abf7d8d3941..884530e50db 100644
--- a/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen.go
+++ b/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen.go
@@ -220,7 +220,6 @@ type ManagedClusterProperties_AutoScalerProfile_STATUS_ARM struct {
 // Deprecated version of ManagedClusterServicePrincipalProfile_STATUS. Use v1api20210501.ManagedClusterServicePrincipalProfile_STATUS instead
 type ManagedClusterServicePrincipalProfile_STATUS_ARM struct {
 	ClientId *string `json:"clientId,omitempty"`
-	Secret   *string `json:"secret,omitempty"`
 }
 
 // Deprecated version of ManagedClusterSKU_Name_STATUS. Use v1api20210501.ManagedClusterSKU_Name_STATUS instead
diff --git a/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen_test.go b/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen_test.go
index edd78a96954..ec077e678df 100644
--- a/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen_test.go
+++ b/v2/api/containerservice/v1beta20210501/managed_cluster_status_arm_types_gen_test.go
@@ -1290,7 +1290,6 @@ func ManagedClusterServicePrincipalProfile_STATUS_ARMGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS_ARM(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterWindowsProfile_STATUS_ARM_WhenSerializedToJson_DeserializesAsEqual(t *testing.T) {
diff --git a/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen.go b/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen.go
index 47704435799..18edd09c68e 100644
--- a/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen.go
@@ -8227,8 +8227,8 @@ func (profile *ManagedClusterProperties_AutoScalerProfile_STATUS) AssignProperti
 // Deprecated version of ManagedClusterServicePrincipalProfile. Use v1api20210501.ManagedClusterServicePrincipalProfile instead
 type ManagedClusterServicePrincipalProfile struct {
 	// +kubebuilder:validation:Required
-	ClientId *string `json:"clientId,omitempty"`
-	Secret   *string `json:"secret,omitempty"`
+	ClientId *string                     `json:"clientId,omitempty"`
+	Secret   *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 var _ genruntime.ARMTransformer = &ManagedClusterServicePrincipalProfile{}
@@ -8248,7 +8248,11 @@ func (profile *ManagedClusterServicePrincipalProfile) ConvertToARM(resolved genr
 
 	// Set property ‘Secret’:
 	if profile.Secret != nil {
-		secret := *profile.Secret
+		secretSecret, err := resolved.ResolvedSecrets.Lookup(*profile.Secret)
+		if err != nil {
+			return nil, errors.Wrap(err, "looking up secret for property Secret")
+		}
+		secret := secretSecret
 		result.Secret = &secret
 	}
 	return result, nil
@@ -8272,11 +8276,7 @@ func (profile *ManagedClusterServicePrincipalProfile) PopulateFromARM(owner genr
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
+	// no assignment for property ‘Secret’
 
 	// No error
 	return nil
@@ -8289,7 +8289,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_From_Mana
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
 	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
+	if source.Secret != nil {
+		secret := source.Secret.Copy()
+		profile.Secret = &secret
+	} else {
+		profile.Secret = nil
+	}
 
 	// No error
 	return nil
@@ -8304,7 +8309,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
 	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
+	if profile.Secret != nil {
+		secret := profile.Secret.Copy()
+		destination.Secret = &secret
+	} else {
+		destination.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -8320,7 +8330,6 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 // Deprecated version of ManagedClusterServicePrincipalProfile_STATUS. Use v1api20210501.ManagedClusterServicePrincipalProfile_STATUS instead
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	ClientId *string `json:"clientId,omitempty"`
-	Secret   *string `json:"secret,omitempty"`
 }
 
 var _ genruntime.FromARMConverter = &ManagedClusterServicePrincipalProfile_STATUS{}
@@ -8343,12 +8352,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) PopulateFromARM(own
 		profile.ClientId = &clientId
 	}
 
-	// Set property ‘Secret’:
-	if typedInput.Secret != nil {
-		secret := *typedInput.Secret
-		profile.Secret = &secret
-	}
-
 	// No error
 	return nil
 }
@@ -8359,9 +8362,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_Fr
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// No error
 	return nil
 }
@@ -8374,9 +8374,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_To
 	// ClientId
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
-	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		destination.PropertyBag = propertyBag
diff --git a/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen_test.go
index f52efed68a9..158b7f7262a 100644
--- a/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1beta20210501/managed_cluster_types_gen_test.go
@@ -3464,7 +3464,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
@@ -3568,7 +3567,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
diff --git a/v2/api/containerservice/v1beta20210501/structure.txt b/v2/api/containerservice/v1beta20210501/structure.txt
index b33f655daaf..a5f44053200 100644
--- a/v2/api/containerservice/v1beta20210501/structure.txt
+++ b/v2/api/containerservice/v1beta20210501/structure.txt
@@ -264,7 +264,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1beta20210501
 │   │   │   └── Type: *string
 │   │   ├── ServicePrincipalProfile: *Object (2 properties)
 │   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (2 properties)
 │   │   │   ├── Name: *Enum (1 value)
 │   │   │   │   └── "Basic"
@@ -554,9 +554,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1beta20210501
 │       │   ├── RequiredMembers: string[]
 │       │   └── Type: *string
 │       ├── ProvisioningState: *string
-│       ├── ServicePrincipalProfile: *Object (2 properties)
-│       │   ├── ClientId: *string
-│       │   └── Secret: *string
+│       ├── ServicePrincipalProfile: *Object (1 property)
+│       │   └── ClientId: *string
 │       ├── Sku: *Object (2 properties)
 │       │   ├── Name: *Enum (1 value)
 │       │   │   └── "Basic"
@@ -847,9 +846,8 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1beta20210501
 │   │   │   ├── RequiredMembers: string[]
 │   │   │   └── Type: *string
 │   │   ├── ProvisioningState: *string
-│   │   ├── ServicePrincipalProfile: *Object (2 properties)
-│   │   │   ├── ClientId: *string
-│   │   │   └── Secret: *string
+│   │   ├── ServicePrincipalProfile: *Object (1 property)
+│   │   │   └── ClientId: *string
 │   │   └── WindowsProfile: *Object (4 properties)
 │   │       ├── AdminPassword: *string
 │   │       ├── AdminUsername: *string
diff --git a/v2/api/containerservice/v1beta20210501/zz_generated.deepcopy.go b/v2/api/containerservice/v1beta20210501/zz_generated.deepcopy.go
index e0ac756eca7..6c1e7a80935 100644
--- a/v2/api/containerservice/v1beta20210501/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1beta20210501/zz_generated.deepcopy.go
@@ -5179,7 +5179,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -5227,11 +5227,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
@@ -5252,11 +5247,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS_ARM) DeepCopyInto(out *Ma
 		*out = new(string)
 		**out = **in
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS_ARM.
diff --git a/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen.go b/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen.go
index 0239afd9c5a..9326a4d8ec3 100644
--- a/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen.go
+++ b/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen.go
@@ -5176,9 +5176,9 @@ func (profile *ManagedClusterProperties_AutoScalerProfile_STATUS) AssignProperti
 // Storage version of v1beta20210501.ManagedClusterServicePrincipalProfile
 // Deprecated version of ManagedClusterServicePrincipalProfile. Use v1api20210501.ManagedClusterServicePrincipalProfile instead
 type ManagedClusterServicePrincipalProfile struct {
-	ClientId    *string                `json:"clientId,omitempty"`
-	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
+	ClientId    *string                     `json:"clientId,omitempty"`
+	PropertyBag genruntime.PropertyBag      `json:"$propertyBag,omitempty"`
+	Secret      *genruntime.SecretReference `json:"secret,omitempty"`
 }
 
 // AssignProperties_From_ManagedClusterServicePrincipalProfile populates our ManagedClusterServicePrincipalProfile from the provided source ManagedClusterServicePrincipalProfile
@@ -5190,7 +5190,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_From_Mana
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
 	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
+	if source.Secret != nil {
+		secret := source.Secret.Copy()
+		profile.Secret = &secret
+	} else {
+		profile.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -5221,7 +5226,12 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
 	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
+	if profile.Secret != nil {
+		secret := profile.Secret.Copy()
+		destination.Secret = &secret
+	} else {
+		destination.Secret = nil
+	}
 
 	// Update the property bag
 	if len(propertyBag) > 0 {
@@ -5248,7 +5258,6 @@ func (profile *ManagedClusterServicePrincipalProfile) AssignProperties_To_Manage
 type ManagedClusterServicePrincipalProfile_STATUS struct {
 	ClientId    *string                `json:"clientId,omitempty"`
 	PropertyBag genruntime.PropertyBag `json:"$propertyBag,omitempty"`
-	Secret      *string                `json:"secret,omitempty"`
 }
 
 // AssignProperties_From_ManagedClusterServicePrincipalProfile_STATUS populates our ManagedClusterServicePrincipalProfile_STATUS from the provided source ManagedClusterServicePrincipalProfile_STATUS
@@ -5259,9 +5268,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_Fr
 	// ClientId
 	profile.ClientId = genruntime.ClonePointerToString(source.ClientId)
 
-	// Secret
-	profile.Secret = genruntime.ClonePointerToString(source.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		profile.PropertyBag = propertyBag
@@ -5290,9 +5296,6 @@ func (profile *ManagedClusterServicePrincipalProfile_STATUS) AssignProperties_To
 	// ClientId
 	destination.ClientId = genruntime.ClonePointerToString(profile.ClientId)
 
-	// Secret
-	destination.Secret = genruntime.ClonePointerToString(profile.Secret)
-
 	// Update the property bag
 	if len(propertyBag) > 0 {
 		destination.PropertyBag = propertyBag
diff --git a/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen_test.go b/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen_test.go
index b66b393ef56..1f0213e614e 100644
--- a/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen_test.go
+++ b/v2/api/containerservice/v1beta20210501storage/managed_cluster_types_gen_test.go
@@ -3435,7 +3435,6 @@ func ManagedClusterServicePrincipalProfileGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterServicePrincipalProfile_STATUS_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
@@ -3539,7 +3538,6 @@ func ManagedClusterServicePrincipalProfile_STATUSGenerator() gopter.Gen {
 // AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS is a factory method for creating gopter generators
 func AddIndependentPropertyGeneratorsForManagedClusterServicePrincipalProfile_STATUS(gens map[string]gopter.Gen) {
 	gens["ClientId"] = gen.PtrOf(gen.AlphaString())
-	gens["Secret"] = gen.PtrOf(gen.AlphaString())
 }
 
 func Test_ManagedClusterSKU_WhenPropertiesConverted_RoundTripsWithoutLoss(t *testing.T) {
diff --git a/v2/api/containerservice/v1beta20210501storage/structure.txt b/v2/api/containerservice/v1beta20210501storage/structure.txt
index 5f84630b281..b83e4509c5c 100644
--- a/v2/api/containerservice/v1beta20210501storage/structure.txt
+++ b/v2/api/containerservice/v1beta20210501storage/structure.txt
@@ -241,7 +241,7 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1beta20210501st
 │   │   ├── ServicePrincipalProfile: *Object (3 properties)
 │   │   │   ├── ClientId: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
-│   │   │   └── Secret: *string
+│   │   │   └── Secret: *genruntime.SecretReference
 │   │   ├── Sku: *Object (3 properties)
 │   │   │   ├── Name: *string
 │   │   │   ├── PropertyBag: genruntime.PropertyBag
@@ -515,10 +515,9 @@ github.com/Azure/azure-service-operator/v2/api/containerservice/v1beta20210501st
 │       │   └── Type: *string
 │       ├── PropertyBag: genruntime.PropertyBag
 │       ├── ProvisioningState: *string
-│       ├── ServicePrincipalProfile: *Object (3 properties)
+│       ├── ServicePrincipalProfile: *Object (2 properties)
 │       │   ├── ClientId: *string
-│       │   ├── PropertyBag: genruntime.PropertyBag
-│       │   └── Secret: *string
+│       │   └── PropertyBag: genruntime.PropertyBag
 │       ├── Sku: *Object (3 properties)
 │       │   ├── Name: *string
 │       │   ├── PropertyBag: genruntime.PropertyBag
diff --git a/v2/api/containerservice/v1beta20210501storage/zz_generated.deepcopy.go b/v2/api/containerservice/v1beta20210501storage/zz_generated.deepcopy.go
index f6dc4817447..c1d02050215 100644
--- a/v2/api/containerservice/v1beta20210501storage/zz_generated.deepcopy.go
+++ b/v2/api/containerservice/v1beta20210501storage/zz_generated.deepcopy.go
@@ -2708,7 +2708,7 @@ func (in *ManagedClusterServicePrincipalProfile) DeepCopyInto(out *ManagedCluste
 	}
 	if in.Secret != nil {
 		in, out := &in.Secret, &out.Secret
-		*out = new(string)
+		*out = new(genruntime.SecretReference)
 		**out = **in
 	}
 }
@@ -2738,11 +2738,6 @@ func (in *ManagedClusterServicePrincipalProfile_STATUS) DeepCopyInto(out *Manage
 			(*out)[key] = val
 		}
 	}
-	if in.Secret != nil {
-		in, out := &in.Secret, &out.Secret
-		*out = new(string)
-		**out = **in
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterServicePrincipalProfile_STATUS.
diff --git a/v2/azure-arm.yaml b/v2/azure-arm.yaml
index 5953c2a2977..686cb44bdde 100644
--- a/v2/azure-arm.yaml
+++ b/v2/azure-arm.yaml
@@ -884,6 +884,9 @@ objectModelConfiguration:
       ManagedClusterAgentPoolProfileProperties:
         ProximityPlacementGroupID:
           $armReference: false # This is true in the next version and we have custom conversion to make round-tripping work
+      ManagedClusterServicePrincipalProfile:
+        Secret:
+          $isSecret: true
       PrivateLinkResource:
         Id:
           $armReference: true
@@ -897,6 +900,9 @@ objectModelConfiguration:
       ManagedClusters_AgentPool:
         $exportAs: ManagedClustersAgentPool
         $supportedFrom: v2.0.0
+      ManagedClusterServicePrincipalProfile:
+        Secret:
+          $isSecret: true
       PrivateLinkResource:
         Id:
           $armReference: true
@@ -910,6 +916,9 @@ objectModelConfiguration:
       ManagedClusters_AgentPool:
         $exportAs: ManagedClustersAgentPool
         $supportedFrom: v2.0.0
+      ManagedClusterServicePrincipalProfile:
+        Secret:
+          $isSecret: true
       PrivateLinkResource:
         Id:
           $armReference: true
diff --git a/v2/internal/controllers/controller_resources_gen.go b/v2/internal/controllers/controller_resources_gen.go
index 2aef2d51d25..f552d60b81d 100644
--- a/v2/internal/controllers/controller_resources_gen.go
+++ b/v2/internal/controllers/controller_resources_gen.go
@@ -298,7 +298,21 @@ func getKnownStorageTypes() []*registration.StorageType {
 		},
 	})
 	result = append(result, &registration.StorageType{Obj: new(containerregistry_v1api20210901s.Registry)})
-	result = append(result, &registration.StorageType{Obj: new(containerservice_v1api20230201s.ManagedCluster)})
+	result = append(result, &registration.StorageType{
+		Obj: new(containerservice_v1api20230201s.ManagedCluster),
+		Indexes: []registration.Index{
+			{
+				Key:  ".spec.servicePrincipalProfile.secret",
+				Func: indexContainerserviceManagedClusterSecret,
+			},
+		},
+		Watches: []registration.Watch{
+			{
+				Src:              &source.Kind{Type: &v1.Secret{}},
+				MakeEventHandler: watchSecretsFactory([]string{".spec.servicePrincipalProfile.secret"}, &containerservice_v1api20230201s.ManagedClusterList{}),
+			},
+		},
+	})
 	result = append(result, &registration.StorageType{Obj: new(containerservice_v1api20230201s.ManagedClustersAgentPool)})
 	result = append(result, &registration.StorageType{Obj: new(datafactory_v1api20180601s.Factory)})
 	result = append(result, &registration.StorageType{Obj: new(dbformariadb_v1api20180601s.Configuration)})
@@ -1875,6 +1889,21 @@ func indexContainerinstanceContainerGroupWorkspaceKey(rawObj client.Object) []st
 	return obj.Spec.Diagnostics.LogAnalytics.WorkspaceKey.Index()
 }
 
+// indexContainerserviceManagedClusterSecret an index function for containerservice_v1api20230201s.ManagedCluster .spec.servicePrincipalProfile.secret
+func indexContainerserviceManagedClusterSecret(rawObj client.Object) []string {
+	obj, ok := rawObj.(*containerservice_v1api20230201s.ManagedCluster)
+	if !ok {
+		return nil
+	}
+	if obj.Spec.ServicePrincipalProfile == nil {
+		return nil
+	}
+	if obj.Spec.ServicePrincipalProfile.Secret == nil {
+		return nil
+	}
+	return obj.Spec.ServicePrincipalProfile.Secret.Index()
+}
+
 // indexDbformariadbServerAdministratorLoginPassword an index function for dbformariadb_v1api20180601s.Server .spec.properties.default.administratorLoginPassword
 func indexDbformariadbServerAdministratorLoginPassword(rawObj client.Object) []string {
 	obj, ok := rawObj.(*dbformariadb_v1api20180601s.Server)