You have an Azure Web App and multiple Azure Function apps that need to load secrets (connection strings, certificates) from Azure Key Vault. Secrets must not be stored in app code or environment, and you want to minimize changes in Azure AD. What approach should you use for accessing Key Vault from the apps?

A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure services, including Web Apps and Function Apps. This approach centralizes identity management, allowing you to grant Key Vault access once to the managed identity and then associate that identity with all your applications. This minimizes changes in Azure AD because you're managing a single identity for multiple apps. Creating a service principal with a client secret is less secure as the secret needs to be stored and managed. System-assigned managed identities are tied to a single resource, requiring individual configuration for each app, which doesn't minimize changes. Using a service principal with a certificate for each app is also more complex to manage than a single user-assigned managed identity.