A development team runs an application on an Azure virtual machine that needs to read secrets from Azure Key Vault. The team wants to avoid storing any credentials, connection strings, or certificates in the application's code or configuration. Which Microsoft Entra identity type should they use to authenticate the VM to Key Vault?