Contoso runs an Azure Function app that must call Azure Key Vault and Azure Storage without embedding credentials. The security team requires that the identity be automatically deleted when the Function app is deleted, and it must NOT be shared with any other resource. Which type of identity should you configure for the Function app?