A supported Azure service must obtain tokens for another Azure resource without storing an application password. Which identity approach fits?

1. Anonymous administrative access
2. A human Global Administrator password in configuration
3. A public storage access key used for every service
4. Managed identity with narrowly scoped target permissions