A team wants least-privilege access to Exadata resources through the Azure integration. Which approach is appropriate?

1. Assume an Azure Reader role grants full Oracle database administration.
2. Remove all service-created OCI policies immediately after onboarding.
3. Grant access by sharing the OCI tenancy administrator's password.
4. Configure the documented Azure role assignments and corresponding OCI access model.