docs(byob): explain Azure authentication options

platform/hosting/data-security/secure-storage-connector.mdx

@@ -381,7 +381,12 @@ For details, see [Create a blob storage container](https://learn.microsoft.com/e
         If data in your bucket expires because of an [object lifecycle management policy](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal), you may lose the ability to read the history of some runs.
         </Note>
 
-1. Generate a storage account access key and make a note of its name and the storage account name. If you use [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud), share the storage account name and access key with your W&B team using a secure sharing mechanism.
+1. Choose an authentication method:
+
+    - **Storage account key**: Generate a storage account access key and record the key and storage account name. For organizations on Dedicated Cloud, share these values with your W&B account team using a secure sharing mechanism.
+    - **Workload identity**: Don't generate or share a storage account key. Instead, the W&B System Console shows the principal ID of the deployment's managed identity. Grant that principal the **Reader** and **Storage Blob Data Contributor** roles on the storage account. W&B configures identity federation through one deployment-wide Kubernetes service account named `wandb-bucket-access`. <Note>For Self-Managed deployments, requires Operator Helm chart [v0.44.4+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.4).</Note>
+
+    Workload identity is an opt-in migration. Existing instance-level BYOB configurations continue to use their storage account key until you change their authentication method.
 
 **Team level BYOB**:
 
@@ -478,10 +483,12 @@ For **Self-Managed**, you can configure instance level BYOB using the W&B App:
 1. Log in to W&B as a user with the `admin` role.
 1. Click the user icon at the top, then click **System Console**.
 1. Navigate to **Settings** > **System Connections**.
-1. In the **Bucket Storage** section, ensure the identity in the **Identity** field has access to the new bucket.
-1. Select the **Provider**.
-1. Enter the **Bucket Name**.
+1. In the **Bucket Storage** section, select **Azure** as the **Provider**.
+1. Enter the storage account name in **Bucket Name**.
 1. Optional: Enter the **Path** to use in the new bucket.
+1. In **Authentication**, select one of the following options:
+    - **Storage account key**: Enter the storage account access key. Use this option to retain an existing key-based BYOB configuration.
+    - **Workload identity (user-delegation SAS)**: Copy the displayed **Managed identity principal ID** and grant it the **Reader** and **Storage Blob Data Contributor** roles on the storage account. You don't need to enter a tenant ID or client ID. <Note>For Self-Managed deployments, requires Operator Helm chart [v0.44.4+](https://github.com/wandb/helm-charts/releases/tag/operator-wandb-0.44.4).</Note>
 1. Click **Save**.
 
 After you save, W&B uses the configured bucket as the default storage destination for new artifacts and run files at the instance level.

snippets/_includes/byob-reference-setup.mdx

@@ -24,7 +24,7 @@ Weave only resolves URIs that point at a bucket registered for your team. Suppor
 
 ## Prerequisites
 
-- This feature is supported only in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud).
+- This feature is supported in [W&B Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud) and in preview for [Dedicated Cloud](/platform/hosting/hosting-options/dedicated-cloud), and [Self-Managed](https://docs.wandb.ai/platform/hosting/hosting-options/self-managed) v0.84+.
 - A W&B account and [API key](https://wandb.ai/authorize).
 - A cloud storage bucket you control (S3 or GCS), containing at least one object.
 - Organization admin permissions. Adding a reference bucket requires the same permission as creating a team in the organization.

snippets/_includes/weave-byob.mdx

@@ -1,3 +1,3 @@
 <Warning>
-[The W&B Platform secure storage connector or BYOB](/platform/hosting/data-security/secure-storage-connector) is not available for Weave.
-</Warning>
+This page is for the W&B platform secure storage connector or BYOB and does not apply to Weave. To render images and video that live in your own cloud bucket in Weave without importing the bytes into Weave, see the [Weave BYOB reference](/weave/guides/tracking/byob-references#reference-media-in-your-own-bucket-byob-using-weave-op).
+</Warning>