An AI platform team uses a system-assigned managed identity for an Azure Functions app that calls Azure OpenAI. The function app has been decommissioned, and a new function app with a different managed identity will replace it. Which Entra ID access control step must be completed to ensure the old identity cannot continue calling Azure OpenAI?

B is correct because when a function app with a system-assigned managed identity is decommissioned, the managed identity is automatically deleted. However, any RBAC role assignments for that managed identity on Azure resources (like Azure OpenAI) must be explicitly removed as a housekeeping step to maintain clean access control records. More importantly, in scenarios where the old identity still exists, removing its role assignment is the action that revokes its permission to call Azure OpenAI. C is wrong because a system-assigned managed identity is deleted automatically when the resource it is assigned to is deleted—you cannot separately disable it in Entra admin center after the function app is removed. A is wrong because API key rotation only impacts callers using keys, not those using managed identity tokens. D is wrong because managed identities do not have refresh tokens that persist after the resource is deleted; token issuance requires the identity to exist.