A company uses Azure Machine Learning with a managed online endpoint that authenticates callers using a key. The security team wants to migrate to token-based authentication using managed identities. The endpoint will be called by an Azure App Service. Which steps correctly implement this migration?

A is correct because Azure Machine Learning managed online endpoints support Microsoft Entra ID token authentication in addition to key authentication. To migrate: (1) Disable key-based authentication on the endpoint to enforce token-only access, (2) Enable a system-assigned managed identity on the Azure App Service (caller) to give it an Entra ID identity without stored credentials, and (3) Assign the AML-appropriate role to the App Service's managed identity so it can call the endpoint. The 'AzureML Data Scientist' role or a custom role with endpoint invoke permissions grants the App Service access to submit scoring requests. B is wrong because the AML endpoint having a managed identity controls what the endpoint itself can access (e.g., storage), not who can call the endpoint. C is wrong because service principals with manual credentials are not credential-free; the question requires managed identity-based auth. D is wrong because Azure App Service does not natively use OAuth2 client credentials flow on its own; managed identity is the credential-free approach.