An Azure-hosted application must read secrets from Key Vault without maintaining a client secret in its configuration. Which identity approach should be recommended?

1. A managed identity with narrowly scoped vault access
2. Anonymous access to all secrets
3. A shared storage account key used as a vault password
4. A tenant-wide Global Administrator user embedded in the app