Manage Azure Key Vault keys and secrets with RBAC authorization instead of legacy access policies

Steps

1. Create a Key Vault with Azure RBAC permission model enabled (set --enable-rbac-authorization true at creation or migrate an existing vault via the portal or CLI)
2. Assign the Key Vault Secrets Officer or Key Vault Crypto Officer built-in role to administrators, and Key Vault Secrets User or Key Vault Crypto User to applications, scoped to the specific vault or a single secret/key
3. Create secrets with az keyvault secret set or the SDK; reference them in applications via the vault URI and secret name, never hardcode the value
4. Create keys (RSA or EC) for encryption or signing operations; use the key identifier URI returned at creation for subsequent operations
5. Use managed identities for Azure-hosted workloads to authenticate to Key Vault without storing credentials; assign the appropriate RBAC role to the managed identity
6. Enable soft-delete and purge protection on the vault to protect against accidental or malicious deletion; consult current docs for retention period ranges