Implement IaC for Machine Learning

A cloud architect is designing GitHub Actions access to an Azure Machine Learning workspace. The workflow submits command jobs, registers model assets, and directly reads a private Blob validation dataset as its own workload principal. Infrastructure creation and compute provisioning are handled by a separate authorized process.

Workspace publicNetworkAccess remains Disabled. An approved workspace private endpoint exists in a customer-managed VNet; the Blob account also has an approved private access path. The workspace's separate managed network governs managed-compute outbound access.

The organization is eligible for GitHub-hosted larger runners with Azure VNet networking and can alternatively use an Azure VM self-hosted runner. In either case, its runner network may be connected to the private resources. Policy requires noninteractive Azure authentication. Required access to GitHub, Microsoft Entra ID, and Azure Resource Manager is permitted; the workspace private endpoint does not replace ARM's management path.

Which three design controls are required to satisfy the stated access requirements? (Choose 3.)