A code reviewer inspecting an internal application notices that the connection string used to call a Foundry-hosted model deployment includes an API key hard-coded directly in the application's source file, which is stored in a shared repository. The application runs on an Azure VM inside the company's tenant. Which change would most improve the security of this authentication approach?

Replacing the hard-coded API key with Microsoft Entra ID authentication through a managed identity assigned to the VM removes the secret from source code entirely; the VM authenticates using an identity issued and managed by Azure, so there is no long-lived credential sitting in a shared repository for anyone with read access to copy. Moving the API key into a comment at the top of the file is incorrect because it does not remove the key from the source file at all; it simply makes an already-exposed secret more visible and easier for anyone browsing the repository to find and misuse. Encrypting the entire source file with a password known only to one developer is incorrect because it breaks the ability of the rest of the team to build, run, or review the application, and it does not eliminate the underlying problem of a static secret; anyone with the password still has full access to the same hard-coded key. Rotating the API key every 90 days but keeping it stored in the source file is incorrect because scheduled rotation reduces how long a leaked key stays valid, but the key still lives in the source file and shared repository the whole time between rotations, leaving the same exposure risk in place until the next rotation. Managed identity removes the secret from the codebase altogether rather than managing it more carefully.