What is the correct sequence when creating a system-assigned identity for a Function App that needs Key Vault access?

1. A Assign the role first, then enable the identity
2. ✓ B Enable the identity, obtain its principal id, then create the role assignment (correct answer)
3. C Create a service principal manually
4. D Copy an existing identity

Shortcut: The identity must exist before it can be granted anything. Enabling it produces a principal id, which is then used as the target of the role assignment.