A security engineer needs to implement a rotation policy for the customer-managed key (CMK) used to encrypt an Azure AI Search index. The organization requires key rotation every 90 days and automatic disabling of old key versions after 180 days. Which Azure Key Vault feature automates this lifecycle?

B is correct because Azure Key Vault supports native key rotation policies at the key level. You can configure a rotation policy that automatically creates a new key version at a specified interval (e.g., 90 days) and notifies or expires old versions after a specified period. When configured correctly, services using CMK (like Azure AI Search) that are configured to use the 'latest' key version automatically use the newly rotated key. This eliminates manual rotation and reduces the risk of key expiration causing service outages. A is wrong because Key Vault access policies control who can perform operations on Key Vault, not key lifecycle rotation schedules. C is wrong because an Azure Automation runbook can automate rotation via code but requires maintenance, is error-prone, and duplicates functionality now built into Key Vault natively. D is wrong because Azure Policy enforces configuration standards on resources; it does not implement cryptographic key lifecycle management or rotation.