You run an Azure App Service with production and staging slots. The app reads secrets from Azure Key Vault using Key Vault references in app settings. You need both slots to use the same identity when accessing Key Vault so that slot swaps do not require Key Vault access changes. What should you do?

The question asks for a solution where both production and staging slots use the same identity for Key Vault access, ensuring slot swaps don't break access. A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure services, including different App Service slots. By creating one user-assigned managed identity and attaching it to both the production and staging slots, both slots will present the same identity when accessing Key Vault. Granting this single identity the necessary Key Vault permissions ensures consistent access regardless of which slot is active or after a swap. Using only system-assigned managed identities for each slot would result in two distinct identities, requiring separate permission grants and potentially complicating management during swaps. Granting access to the app's principal name instead of its object ID is not a standard or effective method for managing Key Vault access with managed identities across slots. While Key Vault reference syntax can specify a client ID, the core problem of ensuring both slots use the same identity is solved by attaching a single user-assigned managed identity to both.