Secrets in Azure for .NET apps: Key Vault with Managed Identity and DefaultAzureCredential

// ======================================================================
// Q: Where do secrets live in Azure?
//
// In Azure Key Vault, accessed through Managed Identity: no connection strings
// or passwords in the repo or pipeline. For the database: Entra ID
// authentication where possible. Locally: dotnet user-secrets.
// Observability: Application Insights / OpenTelemetry, structured logging
// without PII, health checks (/health/ready checking the DB and the ERP), alerts
// on outbox and DLQ size.
// ======================================================================

builder.Configuration.AddAzureKeyVault(
    new Uri(builder.Configuration["KeyVault:Uri"]!), new DefaultAzureCredential());