An ACR Task must authenticate to Azure Key Vault to retrieve a build secret. What is the recommended identity configuration?

1. A Store the Key Vault credential as a task environment variable
2. ✓ B Assign a managed identity to the ACR Task and grant it Key Vault access (correct answer)
3. C Use the ACR admin account credentials
4. D Embed a service principal secret in the Dockerfile

Shortcut: ACR Tasks support system- or user-assigned managed identities. Grant that identity 'Key Vault Secrets User' and reference the secret at build time, so no credential is ever stored in the task or image.