get registered azure app to access key vault

Question

I am having trouble getting my registered azure app (C# .Net Core application running on a user's machine) access to its client secret stored in an azure key vault. The app has been added to an azure ad group that has been given an access policy to the key vault. I feel like this should work, but it doesn't, it returns an "authentication unavailable, no managed identity endpoint found":

var creds = new ManagedIdentityCredential(clientId);
SecretClient secretClient = new SecretClient(new Uri(url), creds);

this block of code works, but only because my user account has an access policy for the key vault as well:

SecretClient secretClient = new SecretClient(new Uri(url), new DefaultAzureCredential());

Is there another step I am missing to set up my registered app or is there another method for establishing credentials using the appid/clientid?

Answer 1

As you have understood, if you don't have the secret, you won't be able to finish the authentication. And without the authentication, you cannot access key vault to get the client secret.

Using a client secret for authentication is not secure and should only be used for testing purposes. The recommended way is to use a client certificate. See this tutorial to learn how to set up a service principal to authenticate to key vault and retrieve a secret.

This third party article is related to how to use client id and client secret to authenticate to the key vault. You can see that we need to know the client secret in advance.