How should Azure Key Vault be designed for production in Microsoft Azure?

Use managed identities, least-privilege RBAC, separate vaults by environment, secret rotation, logging, and private networking where needed. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.