You are developing an Azure Functions app that will read activity logs for a subscription. You want an authentication approach for the function app that minimizes administrative overhead. Which authentication option should you recommend?

System-assigned managed identities are the best choice for minimizing administrative overhead. Azure automatically creates and manages the identity in Azure AD, eliminating the need for you to manage credentials or secrets. This identity can then be granted permissions to access other Azure resources, like activity logs. An enterprise application registered in Azure AD and an application registration in Azure AD both require manual management of client secrets or certificates, increasing administrative overhead. Shared access signatures (SAS) are primarily for granting limited, time-bound access to storage resources, not for authenticating an Azure Function app to read activity logs.