Question

You are developing a C# ASP.NET Core web application deployed to Azure App Service. The application is deployed as two regional instances: app-us-east and app-us-west. Both instances must retrieve shared secrets from a central Azure Key Vault named kv-shared. Additionally, app-us-east must write data to a regional Azure Storage account named sa-east-logs, while app-us-west must write data to sa-west-logs. To configure the managed identities, you perform the following steps:

1. Create a single user-assigned managed identity named uami-shared and assign it to both App Services, granting it Get and List secrets permissions on kv-shared.
2. Enable a system-assigned managed identity on both app-us-east and app-us-west, and grant each regional identity Contributor access to its corresponding regional storage account (sa-east-logs or sa-west-logs).

In your C# code, you instantiate the SDK clients as follows:

csharp
// Accessing the shared Key Vault
var kvClient = new SecretClient(
new Uri("https://kv-shared.vault.azure.net/"),
new DefaultAzureCredential()
);

// Accessing the regional storage account
var blobClient = new BlobServiceClient(
new Uri("https://sa-east-logs.blob.core.windows.net/"),
new DefaultAzureCredential()
);

What is the authentication outcome when the app-us-east instance attempts to run this code and connect to both services?