Question

You are deploying an Azure AI Foundry project that must call a downstream Azure Key Vault to retrieve API secrets at runtime. Security policy prohibits storing any credentials in application code or configuration files, and the Foundry resource was created with a system-assigned managed identity. What is the correct way to grant the Foundry resource access to the Key Vault secrets?

Accepted Answer

Assign the Foundry resource's system-assigned managed identity the 'Key Vault Secrets User' RBAC role scoped to the Key Vault.

Answer

Generate a service principal client secret and store it as an environment variable in the Foundry project.

Answer

Create a shared access signature (SAS) token for the Key Vault and embed it in the application connection string.

Answer

Add the Key Vault access key to the Foundry project's Bicep parameters file during deployment.