Managed Identity Secret Retrieval Flow

Managed identities provide a way for Azure resources to authenticate to Key Vault without storing passwords or API keys in code. A system-assigned identity is tied to the lifecycle of a single resource—when the resource is deleted, the identity is removed automatically. A user-assigned identity is created as a separate resource and can be assigned to multiple resources, offering more flexibility. When a resource has a managed identity, it can request secrets from Key Vault, and the vault verifies the identity has permission before returning the value. This flow means the application never contains the actual secret.