How should Azure Key Vault be designed for production in Microsoft Azure?

Use managed identities, least-privilege RBAC, separate vaults by environment, secret rotation, logging, and private networking where needed.