A canal authority recycles VM scale-set instances weekly but needs the same identity and the same Azure role assignments to survive instance replacement. What should the security engineer create?
Select an answer to reveal the explanation.
Short Explanation
Scale-set instances come and go like canal barges. Hang one user-assigned identity on the fleet so the Azure roles stay put when the hulls get swapped.
Full Explanation
User-assigned managed identities are independent Azure resources that can be attached to multiple compute resources and retain their Azure RBAC assignments across instance recycling. System-assigned identities die with each instance, forcing repeated role grants. Embedding app passwords in custom data reintroduces credential management. Entra group membership on NICs is not the supported pattern for workload identity to Azure resources.