You have an Azure Key Vault named KV1 and three web servers where you will deploy an application named App1. To allow App1 to retrieve a secret from KV1 while minimizing the number of permission grants and following least privilege, what should you include in the solution?

A user-assigned managed identity is the correct choice because it can be assigned to multiple Azure resources, such as your three web servers, allowing them all to authenticate to KV1 using the same identity. This minimizes permission grants as you only need to grant KV1 access to this single managed identity, rather than to each server individually. It adheres to the principle of least privilege by providing an identity specifically for App1's needs, rather than a broader service principal. Role-based access control (RBAC) permissions define what an identity can do, but not the identity itself. A system-assigned managed identity is tied to a single resource's lifecycle, meaning you'd need three separate identities (one for each web server), increasing management overhead and permission grants. A service principal is a general-purpose identity for applications and services, but a user-assigned managed identity is a more secure and convenient option within Azure for this scenario, as Azure handles its lifecycle and credential management.