An Azure Machine Learning workspace must authenticate to an Azure Container Registry (ACR) to pull custom Docker images for compute environments. The security team requires that no service principal secrets are used. Which authentication method should be configured?

B is correct because Azure Machine Learning workspaces support managed identities, and the workspace can be configured to use its managed identity to authenticate to Azure Container Registry. Granting the managed identity the 'AcrPull' role on the ACR allows AML to pull images without any stored secrets, service principal credentials, or admin account passwords. B is the most secure, credential-free approach. A is wrong because the ACR admin account is a static credential that should be disabled per security best practices; storing it in Key Vault reduces but does not eliminate the credential risk. C is wrong because SAS tokens are time-limited but still represent stored credentials that require management and rotation. D is wrong because basic authentication with rotating passwords is credential-based and violates the requirement for no service principal secrets.