Multiple Azure keyvaults linked to same App configuration lead to auth error in spring boot app

My configuration is the following:

An Azure app configuration contains linked keyvalue references to 2 different keyvaults, each is linked to a section with a different prefix.

A spring boot application is authenticated to the app configuration and to one of the keyvaults

In my app I only need the values from one of the keyvaults (the one linked to the kafka section) and I have a filter in the Configuration to only pull a section of the app configuration

In my Application.java I have the code for linking the appconfiguration

    @EnableConfigurationProperties({
            KafkaSettings.class})

and the section filter in the respective class.

    @ConfigurationProperties(prefix = "kafka")
    public class KafkaSettings {
       private String bootstrapServers;
       ...

I would expect this to work but I still receive the authentication error that my app is not authorized to read secrets from the Storage keyvault which I don't need.

Status code 403, "{"error":{"code":"Forbidden","message":"The user, group or application 'appid=<appid>' does not have secrets get permission on key vault '<keyvaultname>'

As expected the issue is resolved if I add the permissions for the second keyvault, but that is not my goal, I want to avoid assigning permissions this keyvault unnecessarily.

My question is, is it possible to tell my app to only pull the secrets from the necessary keyvault and ignore the other one, or did I do a fondamental error by linking multiple keyvaults with different permissions to the same App configuration?

Any help is appreciated

When an app setting in Azure references a Key Vault secret via a Shared Access Signature (SAS) URL, Azure App Service retrieves the secret value from the Key Vault and caches it at startup. The secret is not fetched every time the app accesses the app setting or runs a piece of code that references the app setting.

So, regardless of whether you need it or not, or whether it is used in code, the app will try to connect to the second Key Vault.

Double check that it is not used in your app and simply remove the settings or nullify their values.