@LeedsDBA Yeah I would always push for AD auth even for apps. In the 2017 migration we just completed we managed to remove all but two app service sql logins for the very reasons you note
@LeedsDBA Look up Ssdt static code analysis. Can run these rules as part of build and fail build if rules don't pass. You can write custom rules too. Devs can run these in Vis studio while developing as well