You are developing a C# ASP.NET Core web application hosted on an Azure App Service. The App Service is already configured with a system-assigned managed identity to access an Azure SQL Database. You need to configure the App Service to access secrets in an Azure Key Vault. The Key Vault uses Azure Role-Based Access Control (Azure RBAC) for its data plane authorization. To minimize the security blast radius, you must use a user-assigned managed identity for Key Vault access. You must implement the solution using the Azure.Identity SDK and the DefaultAzureCredential class without modifying the initialization parameters of DefaultAzureCredential in your application code. Which sequence of steps should you perform to successfully retrieve the secrets?
- 1Run the `az identity create` command to provision the user-assigned managed identity and output its client ID and principal ID.
- 2Run the `az role assignment create` command to assign the 'Key Vault Secrets User' role to the identity's principal ID at the Key Vault scope.
- 3Run the `az webapp identity assign` command to associate the newly created user-assigned managed identity with the Azure App Service.
- 4Run the `az webapp config appsettings set` command to add the `AZURE_CLIENT_ID` app setting, setting its value to the client ID of the user-assigned managed identity.
- 5Deploy the ASP.NET Core application code that instantiates the `SecretClient` using `new DefaultAzureCredential()`.