Several supported resources must share one managed identity that remains when any single resource is replaced. Which type fits?

1. A resource group tag
2. System-assigned identity on one VM
3. A directory user's password
4. User-assigned managed identity