A development team has built an application that runs on an on-premises server and needs to authenticate to Microsoft Entra ID to call a cloud API. Because the server is not an Azure resource, a managed identity cannot be used. Which Microsoft Entra identity type should be created to represent this application so it can obtain tokens and access the API?