Service Principal and Certificate with Azure Key Vault

Program.cs

public class Program
{
  public static void Main(string[] args)
  {
      CreateHostBuilder(args).Build().Run();
  }

  public static IHostBuilder CreateHostBuilder(string[] args) =>
      Host.CreateDefaultBuilder(args)
          .ConfigureAppConfiguration((context, config) =>
          {
              var keyVaultEndpoint = GetKeyVaultEndpoint();
              if (!string.IsNullOrEmpty(keyVaultEndpoint))
              {
                  // In below connection string, replace
                  //   {ClientId} with actual GUID representing client id 
                  //   {TenantId} with tenant id of Azure AD
                  //   {Thumbprint} with the subject of certificate
                  //   StoreLocation is CurrentUser for our demo
                  var thumbprintConnString = "RunAs=App;AppId={ClientId};TenantId={TenantId};CertificateThumbprint={Thumbprint};CertificateStoreLocation={LocalMachine or CurrentUser};";
                  
                  // In below connection string, replace
                  //   {ClientId} with actual GUID representing client id 
                  //   {TenantId} with tenant id of Azure AD
                  //   {Subject} with the subject of certificate
                  //   StoreLocation is CurrentUser for our demo
                  var subjectConnString = "RunAs=App;AppId={ClientId};TenantId={TenantId};CertificateSubjectName={Subject};CertificateStoreLocation={LocalMachine or CurrentUser}";
                  
                  var azureServiceTokenProvider = new AzureServiceTokenProvider(thumbprintConnString);
                  
                  var keyVaultClient = new KeyVaultClient(
                      new KeyVaultClient.AuthenticationCallback(
                          azureServiceTokenProvider.KeyVaultTokenCallback));
                  config.AddAzureKeyVault(keyVaultEndpoint, keyVaultClient, new DefaultKeyVaultSecretManager());
              }
          })
          .ConfigureWebHostDefaults(webBuilder =>
          {
              webBuilder.UseStartup<Startup>();
          });

  private static string GetKeyVaultEndpoint() => "https://<<your-key-vault>>.vault.azure.net";
}