You plan to deploy an SAP environment on Azure.

You plan to store all SAP connection strings securely in Azure Key Vault without storing credentials on the Azure virtual machines that host SAP.

What should you configure to allow the virtual machines to access the key vault?

A. Azure Active Directory (Azure AD) Privilege Identity Manager (PIM)
B. role-based access control (RBAC)

C. a Managed Service Identity (MSI)

D. the Custom Script Extension

Explanation:
To reference a credential stored in Azure Key Vault, you need to:
1. Retrieve data factory managed identity
2. Grant the managed identity access to your Azure Key Vault
3. Create a linked service pointing to your Azure Key Vault.
4. Create data store linked service, inside which reference the corresponding secret stored in key vault.

References:
https://docs.microsoft.com/bs-latn-ba/azure/data-factory/store-credentials-in-key-vault