title: Access azure key vault secret with application client secret
body: <p>Problem statement: retrieve and use a sensitive value (say a database connection string) stored in azure key vault programmatically in a web/console c# app.</p>
  <p>I understand you can register an app in AAD and use its client id and client secret to generate an ad token programmatically which can be used to call/access azure key vault secrets.</p>
  <p>My confusion is that the client secret itself is a sensitive ‘password’ which you would want to store in the key vault. Once someone knows the client secret they can access all secrets in the key vault. So how does it make sense to create a new secret (client secret) to store and access the original secret? (Can someone pls explain the logic behind this? Thanks!</p>