Several supported application resources must share one independently managed identity whose lifecycle survives replacement of any one resource. Which identity type fits?

1. System-assigned identity on one replaceable VM
2. A shared local operating-system account
3. User-assigned managed identity
4. An unregistered DNS alias