When configuring an Azure Kubernetes Service (AKS) cluster to connect to an Azure Container Registry, you want the cluster to use its auto-generated service principal to authenticate to the registry. What should you create?

An Azure AD role assignment is the correct choice because it grants the AKS cluster's service principal the necessary permissions to pull images from the Azure Container Registry. Specifically, you would assign the AcrPull role to the service principal on the container registry resource. This establishes an authorization link, allowing the AKS cluster to authenticate and access the registry using its managed identity. An Azure AD group is incorrect because while groups can be assigned roles, directly assigning the role to the service principal is more direct and appropriate for machine-to-machine authentication in this context. An Azure AD user is incorrect as AKS clusters authenticate using service principals or managed identities, not individual user accounts. A secret in Azure Key Vault is incorrect because while Key Vault can store credentials, the question specifically asks for authentication using the cluster's auto-generated service principal, which relies on Azure AD role-based access control (RBAC), not stored secrets for this particular scenario.