How the application hosted in the Azure Virtual Machine will fetch the keys and secrets from the Azure Key vault?

I was referring to this link. It says "Create a system-assigned identity for the virtual machine"

My question is: is it just assigning the system assigned managed identity will allow the application hosted (in the IIS of Azure VM) in the Azure VM will fetch the credentials (Keys/Secrets etc..) from the Key vault for the app to run? or any additional configurations needs to be made as well? If yes, what are those?

Note, the Azure Virtual Machine and the Key vaults are in the same Azure resource group.

Edit

I'm trying to use the below steps:

 Step1: From VM turn on the managed identity for that VM

 Step2: From KV in the access policy, added VM MI to access the KV 
        in the access policy.

 Step3: Now to test it, what is the exact PowerShell command I 
        should use from the VM?

 Step4: I think, once I use the PowerShell command, I can Invoke 
        the rest method and replace my KV URI and secret name.

 Step5: Then use the same REST API in my application.

How can I do these three steps exactly?

Note

From the web, I see people using below command. But I am not sure what is that IP address (it has HTTP in it - which I think is NOT safe)? Is this the IP address and exact command MSFT is suggesting? I am unable to get anything from MSFT tutorial, are there other MSFT tutorials to get the exact details?

$Response = Invoke-RestMethod -uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3F%2A%2Fvault.azure.net' -Method GET -Headers @{Metadata="true"}

$KeyVaultToken = $Response.access_token

How the application hosted in the Azure Virtual Machine will fetch the keys and secrets from the Azure Key vault?

While creating a Key Vault, make sure to select the resource access configuration.

Note: There is no need to generate a token to access the Key Vault from within the VM; a token is only required when accessing the Key Vault from outside the VM.

Make sure to add the VM's managed identity to the Key Vault access policies with the required permissions.

Once the role is assigned, make sure to log in with the VM's managed identity using the command below

Add-AzAccount -identity

Identity Login in VM

Here is the code to fetch keys and secrets from the Key Vault using the VM's managed identity with default credentials. The managed identity will automatically handle the login.

using System;
using Azure.Core;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using Azure.Security.KeyVault.Keys;

class Program
{
    static void Main(string[] args)
    {
        string keyVaultName = "VM-Keyvault-Demo";
        var kvUri = "https://VM-Keyvault-Demo.vault.azure.net";

        
        SecretClientOptions secretOptions = new SecretClientOptions()
        {
            Retry =
            {
                Delay= TimeSpan.FromSeconds(2),
                MaxDelay = TimeSpan.FromSeconds(16),
                MaxRetries = 5,
                Mode = RetryMode.Exponential
            }
        };

        var secretClient = new SecretClient(new Uri(kvUri), new DefaultAzureCredential(), secretOptions);

        
        KeyClientOptions keyOptions = new KeyClientOptions()
        {
            Retry =
            {
                Delay = TimeSpan.FromSeconds(2),
                MaxDelay = TimeSpan.FromSeconds(16),
                MaxRetries = 5,
                Mode = RetryMode.Exponential
            }
        };

        var keyClient = new KeyClient(new Uri(kvUri), new DefaultAzureCredential(), keyOptions);

        
        Console.WriteLine("Listing all secrets in " + keyVaultName + ":");
        foreach (var secret in secretClient.GetPropertiesOfSecrets())
        {
            Console.WriteLine($"- Secret Name: {secret.Name}");
        }

        
        Console.WriteLine("\nListing all keys in " + keyVaultName + ":");
        foreach (var key in keyClient.GetPropertiesOfKeys())
        {
            Console.WriteLine($"- Key Name: {key.Name}");
        }
    }
}

Output

Reference: Use Azure Key Vault with a virtual machine in .NET