Which approach is correct for a CI/CD pipeline that must deploy to Azure without stored secrets?

1. A A service principal with a client secret in the pipeline
2. ✓ B Workload identity federation between the CI provider and an Entra ID application (correct answer)
3. C A shared user account
4. D A certificate committed to the repository

Shortcut: Federated credentials let the pipeline exchange its own OIDC token for an Azure token. No client secret is created, stored, or rotated.