You deployed a Logic App that invokes an Azure Function (with an OpenAPI definition) which accesses an Azure Blob storage account. All resources are protected by Azure AD. The Logic App must securely access the Blob storage, and any Azure AD identities should persist even if the Logic App is deleted. Which option should you choose?

A user-assigned managed identity is the correct choice because it is a standalone Azure resource, allowing it to persist even if the associated Logic App is deleted. This meets the requirement for identity persistence. By assigning appropriate role-based access controls (RBAC) to this managed identity on the Azure Blob storage account, the Logic App can securely access the storage. An Azure AD custom role is incorrect because it defines permissions, not an identity. Azure Key Vault with a client certificate is a valid security mechanism but doesn't directly address the identity persistence requirement for the Logic App itself. A system-assigned managed identity is tied to the lifecycle of the Azure resource (the Logic App in this case), meaning it would be deleted if the Logic App is deleted, failing the persistence requirement.