An application needs to retrieve a Key Vault secret without storing credentials in code. Which approach is recommended?
- A Hard-code the vault URI and secret name with SAS
- B Use managed identity to authenticate; assign Key Vault Secrets User role (correct answer)
- C Store credentials in environment variables
- D Use a certificate thumbprint stored on disk
Shortcut: Managed identity (system or user-assigned) authenticates to Key Vault without credentials. Assign the identity the Key Vault Secrets User role (RBAC) or add it to the vault's access policy.