A deployment pipeline authenticates to Azure. The team wants to avoid maintaining a long-lived client secret where supported. Which service-connection authentication approach should it use?

1. A storage account key used for all ARM operations
2. Workload identity federation with appropriate scoped permissions
3. Anonymous production resource access
4. A permanent Global Administrator password committed to YAML