A company hosts its ERP system in Azure and needs controlled user access. Which Azure service should they use?

Azure Active Directory (Azure AD) is the correct choice because it is Microsoft's cloud-based identity and access management service. It enables secure authentication and authorization for users accessing cloud resources like an ERP system hosted in Azure. Azure AD allows you to manage user accounts, groups, and apply conditional access policies. Azure Policy is used for enforcing organizational standards and assessing compliance, not for user authentication. Azure Logic Apps are for automating workflows and integrating services. Azure Blob Storage is an object storage solution for unstructured data, not an identity service.