You have an Azure key vault named KV1 and three web servers. You plan to deploy an app named App1 to the web servers. You need to ensure that App1 can retrieve ...

You have an Azure key vault named KV1 and three web servers.
You plan to deploy an app named App1 to the web servers.
You need to ensure that App1 can retrieve a secret from KV1. The solution must meet the following requirements:
• Minimize the number of permission grants required.
• Follow the principle of least privilege.
What should you include in the solution?

A. role-based access control (RBAC) permission B. a system-assigned managed identity C. a user-assigned managed identity D. a service principal