An Azure application calls an eligible AI service using a key embedded in its source. The organization wants keyless authentication where supported. Which approach fits?

1. Put the key in the system prompt
2. Make the AI resource anonymously writable
3. Use a managed identity with the required service role and supported token authentication
4. Replace the key with a Global Administrator password