You operate a VM scale set and multiple Function Apps that must access Azure Key Vault and Azure Storage with a common, reusable identity across resources and regions. The identity must outlive any single resource. The workloads also need to obtain OAuth tokens to call a partner API that trusts Entra ID, without storing secrets. What should you do? Each correct answer presents part of the solution.

A user-assigned managed identity is the correct choice because it can be shared across multiple resources (VM scale sets and Function Apps) and regions, and its lifecycle is independent of the resources it's assigned to. This meets the requirement for a common, reusable identity that outlives any single resource. Assigning it the Key Vault Secrets User and Storage Blob Data Contributor roles grants the necessary access. Requesting tokens for the partner API's application ID URI via the managed identity endpoint (IMDS for VMs or the App Service token endpoint for Function Apps) allows the workloads to obtain OAuth tokens without storing secrets, as required. System-assigned managed identities are tied to a single resource and cannot be shared. An app registration with a client secret would require secret management, which the prompt explicitly avoids. The legacy Azure AD Graph API is not relevant for obtaining tokens for a partner API, and managed identities do support obtaining tokens for Microsoft Graph and other Entra ID-protected resources.