You are developing an Al-powered API that retrieves connection strings and API keys from Azure Key Vault. You must configure a solution that provides…

To authenticate to Azure Key Vault without storing credentials in application files, the API should utilize a system-assigned managed identity (D). This identity is tied directly to the lifecycle of the specific application resource, which inherently minimizes the blast radius if the application is compromised. To enforce the principle of least privilege, this managed identity must be granted the Key Vault Secrets User role specifically at the vault scope (C). This ensures the identity only has the minimum permissions necessary to read secret contents and cannot manage the vault or access other resources within the subscription.

A. Storing secrets in App Configuration contradicts the requirement to use Key Vault for secrets and does not solve the authentication challenge.

B. Assigning the Key Vault Administrator role at the subscription scope violates the principle of least privilege and maximizes the blast radius.

Microsoft Learn: "Provide access to Key Vault keys

certificates

and secrets with an Azure role-based access control" (Section: Assign the Key Vault Secrets User role).

Microsoft Learn: "What are managed identities for Azure resources?" (Section: System-assigned managed identity).