You need to allow a specific user to add and delete certificates in an Azure Key Vault while following the principle of least privilege. Which option should you use?

A key vault access policy is the correct choice because it provides granular control over permissions within a specific Azure Key Vault. You can define which users, groups, or applications have permissions to perform operations like 'Get', 'List', 'Set', and 'Delete' on keys, secrets, or certificates. This directly adheres to the principle of least privilege by allowing you to grant only the necessary permissions for certificate management to the specific user. Azure Policy is used for enforcing organizational standards and assessing compliance across resources, not for granting specific data plane access to individual users within a Key Vault. Azure AD Privileged Identity Management (PIM) manages, controls, and monitors access to important resources in Azure AD, Azure, and other Microsoft online services, primarily for just-in-time access or approval workflows for elevated roles, not for direct certificate management permissions within a Key Vault. Azure DevOps is a suite of development tools and services, completely unrelated to managing Key Vault access.