An Azure Container Apps application needs to access Key Vault secrets securely. What is the recommended approach?

1. A Store the Key Vault access key in a Container Apps secret
2. ✓ B Use system-assigned managed identity on the Container App + Key Vault Secrets User role (correct answer)
3. C Use a service principal client secret stored in the environment variable
4. D Configure the Key Vault firewall to allow Container Apps IPs

Shortcut: Container Apps supports system-assigned managed identity. Assign it the Key Vault Secrets User role. The app authenticates to Key Vault using the identity without any stored credentials.