An Azure application needs a secret from Key Vault without a hardcoded client secret. Which design should it use where supported?

1. Use a storage key as a universal vault identity
2. Managed identity authentication with the required vault access permission
3. Grant every internet user access to the vault
4. Store the vault's administrator password in source code