Which identity should a multi-container application use so that each container has distinct vault permissions?
- A One shared system-assigned identity
- B Separate user-assigned managed identities with individually scoped role assignments (correct answer)
- C The subscription service principal
- D A shared client secret
Shortcut: User-assigned identities can be created per workload and granted only the objects each needs, preserving least privilege and clear audit attribution.