Library IT stores a vendor API token in Azure Key Vault for catalog ingest and must limit who can retrieve it for Databricks jobs. What should they configure?

Library IT should scope Azure Key Vault permissions so only the catalog-ingest job identity can fetch the vendor API token. Least privilege on secrets means access policies or Key Vault RBAC grant get (and list only if required) to that job identity—not Secrets Officer manage rights for the token lifecycle. The limited key ring opens one drawer for ingest; casual library staff cannot walk away with the vendor token. Granting the Azure Key Vault Secrets Officer role to the catalog-ingest job identity gives it secret management power to create, update and delete when it only needs to fetch the token, violating least privilege. Configuring a Databricks secret scope using manual entry copies the vendor API token out of Key Vault into Databricks, bypassing centralized vault access control, auditing and rotation. Assigning the Key Vault Secrets User role to the catalog-ingest job identity at vault scope grants get on every secret in the vault rather than a narrow get on only the vendor API token. Exam caveat: Databricks secret scopes referencing Key Vault still depend on correct Azure permissions for the Databricks/job identity; misconfigured backend access breaks jobs or overshares. Rotate vendor tokens on a schedule and update Key Vault versions without code changes. Operational check: assign Key Vault secrets user (or narrower get) only to the ingest SP/managed identity, deny broad workspace access, run the ingest job successfully, and attempt secret read as a normal librarian account expecting failure.