Explanation:

In Microsoft Entra ID (formerly Azure AD), Managed Identities for Azure resources are the built-in way for an Azure resource to authenticate to other Azure services without storing credentials. Microsoft's documentation states: "Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory." It further distinguishes the two types and clarifies the one used here: "A system-assigned managed identity is enabled directly on an Azure service instance. When enabled, Azure creates an identity for the instance in Azure AD." Microsoft also emphasizes the lifecycle binding:
"This identity is tied to the lifecycle of that service instance and is deleted when the resource is deleted." Once enabled, the resource can call Azure services by requesting tokens: "You can use this identity to obtain Azure AD tokens for authentication to services that support Azure AD authentication." Because the prompt explicitly says "system-assigned", the correct completion is managed identity. The other options do not match Microsoft's definition: a user identity refers to a human user; a service principal is the underlying object applications use but isn't what Azure terms "system-assigned"; and an Azure AD-joined device pertains to device registration, not resource-to-service authentication. Therefore, the sentence correctly reads: "An Azure resource can use a system-assigned managed identity to access Azure services."