AKS workloads should access eligible Azure resources without a shared secret embedded in every Pod. Which capability should be evaluated?

1. An unrestricted anonymous backend
2. Supported Microsoft Entra Workload ID integration with scoped target access
3. A namespace name used as the complete credential
4. A shared administrator password baked into the image