You are designing a point-of-sale (POS) solution to be deployed across multiple locations. Each location will host several on-premises applications that must authenticate to an Azure Databricks workspace in the Standard tier. The solution should minimize administrative overhead related to staff turnover and credential management. Which authentication method should you configure for the on-premises application to access the workspace?

An Azure Active Directory service principal (app registration with client credentials) is the most suitable choice because it provides a secure and manageable way for applications to authenticate to Azure resources without relying on individual user credentials. This minimizes administrative overhead as staff turnover does not impact the application's access, and credential management is centralized within Azure AD. Managed identities (system- or user-assigned) are designed for Azure resources to authenticate to other Azure services, not for on-premises applications. Personal Access Tokens (PATs) are tied to individual user accounts, making them prone to issues during staff turnover and less secure for application-to-application authentication.