Azure keyvault from on prem .net app without exposing clientid/clientsecret?

Question

I've registered my app in azure AD and created a client secret and then created a vault and added a secret for the dbconnectionstring below. It works ok but I need the "client-id" and "client-secret" since the identity is managed as service principal. Is there a way to get thos values through an API so that my app doesn't have to save those in the config? It's kind of defeating the purpose since thos whole exercise was to avoid having to save connection strings in the web.config/appsettings.json; as now I can save those in the vault but I would need to save the clientid/secret in the config.

        var kvClient = new KeyVaultClient(async (authority, resource, scope) =>
        {
            var context = new AuthenticationContext(authority);
            var credential = new ClientCredential("client-id", "client-secret");
            AuthenticationResult result = await context.AcquireTokenAsync(resource, credential);
            return result.AccessToken;
        });
        try
        {
            var connStrENTT = kvClient.GetSecretAsync("https://myvault.vault.azure.net/", "DBConfigConnection").Result.Value;
        }

Answer 1

Why do you need to acquire token via your code if you are using managed identity? Managed identity is supposed to hide this for you.

Please use the guidance provided in a sample like this to take the correct steps.