An App Service using a Key Vault reference cannot resolve a secret. Which cause is most likely?
- A The secret name contains a hyphen
- B The app's managed identity lacks Get permission on secrets (access policy or Key Vault Secrets User role) (correct answer)
- C Key Vault references are unsupported in App Service
- D The secret is too long
Shortcut: Key Vault references resolve using the app's managed identity. Without Get on secrets, via either an access policy or the Key Vault Secrets User RBAC role, resolution fails and the setting stays unresolved.