There are three ways to authenticate to Azure Key Vault:
1. Managed Identities
Managed Identities are assigned to Azure resources which needs access to Azure Key Vault. This is the recommended approach as Azure automatically rotates the identity and app/service doesn’t have to manage the secret.
Refer to What are managed identities for Azure resources? to know more about managed identities.
2. Service Principal and Secret
You can use a Service Principal and a secret to access a key vault. However, not recommended as it is hard to automatically rotate the secret used to authenticate to Key Vault.
3. Service Principal and Certificate
You can use a Service Principal and associated certificates to access key vault. The application owner/developer is required to rotate the certificates.