A trusted external CI workload needs Azure access without storing a long-lived Entra client secret. Which authentication approach should be evaluated?

1. Workload identity federation with a narrowly configured trust
2. A permanent administrator password in repository variables
3. A public SAS token used for directory administration
4. Anonymous tenant access