docs(byob): explain Azure authentication options

platform/hosting/data-security/secure-storage-connector.mdx

@@ -381,7 +381,12 @@ For details, see [Create a blob storage container](https://learn.microsoft.com/e
         If data in your bucket expires because of an [object lifecycle management policy](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal), you may lose the ability to read the history of some runs.
         </Note>
 
-1. Generate a storage account access key and make a note of its name and the storage account name. If you use [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud), share the storage account name and access key with your W&B team using a secure sharing mechanism.
+1. Choose an authentication method:
+
+    - **Storage account key**: Generate a storage account access key and record the key and storage account name. For Dedicated Cloud, share these values with your W&B team through a secure sharing mechanism.
+    - **Workload identity**: Don't generate or share a storage account key. The W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide `wandb-bucket-access` Kubernetes ServiceAccount.
+
+    Workload identity is an opt-in migration. Existing instance-level BYOB configurations continue to use their storage account key until you change their authentication method.
 
 **Team level BYOB**:
 
@@ -478,10 +483,12 @@ For **Self-Managed**, you can configure instance level BYOB using the W&B App:
 1. Log in to W&B as a user with the `admin` role.
 1. Click the user icon at the top, then click **System Console**.
 1. Navigate to **Settings** > **System Connections**.
-1. In the **Bucket Storage** section, ensure the identity in the **Identity** field has access to the new bucket.
-1. Select the **Provider**.
-1. Enter the **Bucket Name**.
+1. In the **Bucket Storage** section, select **Azure** as the **Provider**.
+1. Enter the storage account name in **Bucket Name**.
 1. Optional: Enter the **Path** to use in the new bucket.
+1. In **Authentication**, select one of the following options:
+    - **Storage account key**: Enter the storage account access key. Use this option to retain an existing key-based BYOB configuration.
+    - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. This option requires the `operator-wandb` chart version 0.44.0 or later and a configured `global.azureStorageIdentity`.
 1. Click **Save**.
 
 After you save, W&B uses the configured bucket as the default storage destination for new artifacts and run files at the instance level.