In the contoso.com tenant you have an App Service web app App1 and a Key Vault KV1 containing a wildcard certificate for contoso.com. User1 is Owner of both App1 and KV1. What should you do first to configure App1 to use the wildcard certificate stored in KV1?

To allow App1 to access the certificate in KV1, App1 needs an identity that can be granted permissions to KV1. Assigning a managed identity (specifically a system-assigned managed identity in this context, though the option states "user identity" which is also a valid approach for App Service) to App1 provides it with an Azure AD identity. This identity can then be used to create an access policy in KV1, granting App1 the necessary permissions (Get and List for certificates). Creating an access policy for KV1 and assigning the Microsoft Azure App Service principal to the policy is incorrect because the generic App Service principal does not represent your specific App1 instance. Assigning a managed identity first creates a unique identity for App1. Configuring KV1 to use RBAC is an alternative authorization model, but it's not the first step to enable App1 to access the certificate; an identity for App1 is still required. Creating an access policy for KV1 and assigning the policy to User1 is incorrect because User1's permissions do not automatically transfer to App1; App1 needs its own permissions.