A company runs several Azure VMs that need to read secrets from Azure Key Vault and read blobs from an Azure Storage account. Currently the applications on the VMs authenticate using a service principal whose client secret is stored in a local configuration file. The security team wants to eliminate stored credentials and avoid any manual secret rotation while keeping the solution native to Azure. Which authentication approach should you recommend?