A security engineer is implementing a Bring Your Own Key (BYOK) strategy for an Azure AI Foundry deployment. The customer-managed key is stored in Azure Key Vault. The security team requires that the key must be rotated every 90 days. Which configuration ensures automatic key rotation without service disruption to the AI Foundry workspace?

A is correct because Azure Key Vault supports automatic key rotation policies that generate a new key version at defined intervals (90 days). When Azure AI Foundry's CMK configuration references the key using a 'Latest' version URI (without a specific version suffix), the service automatically uses the newest key version after rotation, ensuring seamless automatic rotation without service disruption or manual intervention. B is incorrect because manual rotation every 90 days is operationally risky (human error, missed rotations) and requires downtime-sensitive configuration changes; automated rotation is preferable. C is incorrect because an Azure Function for key rotation adds unnecessary custom code when Key Vault's native key rotation policy achieves the same result without custom development. D is incorrect because key expiration in Key Vault makes an expired key unavailable, which would cause service disruption; key rotation (generating a new version) is different from key expiration.