Add Azure Key Vault support and enhance credential handling in configuration data

Readme.md

@@ -188,6 +188,17 @@ Register-DSCConfigurationDataCredentialProvider `
     -SettingsPath 'C:\DSC\Contoso'
 ```
 
+Azure Key Vault can be registered as a settings file without storing Azure credentials. Authentication is expected to come from the active Az context, managed identity, service principal login, or another external Azure authentication flow:
+
+```powershell
+Register-DSCConfigurationDataCredentialProvider `
+    -Provider AzureKeyVault `
+    -Vault contoso-kv `
+    -SubscriptionId '00000000-0000-0000-0000-000000000000' `
+    -TenantId '11111111-1111-1111-1111-111111111111' `
+    -SettingsPath 'C:\DSC\Contoso'
+```
+
 Provider setup can be removed again:
 
 ```powershell
@@ -287,6 +298,7 @@ Built-in providers:
 - `KeePass`: uses `PoShKeePass` / `Get-KeePassEntry`
 - `SecretManagement`: uses `Microsoft.PowerShell.SecretManagement` / `Get-Secret`
 - `SecretStore`: convenience provider for local SecretStore vaults through `Get-Secret`
+- `AzureKeyVault`: uses `Az.KeyVault` / `Get-AzKeyVaultSecret`
 
 SecretManagement example:
 
@@ -318,6 +330,33 @@ FarmPassphrase = @{
 }
 ```
 
+Azure Key Vault example:
+
+```powershell
+SetupCredential = @{
+    Type = 'credential'
+    Required = $true
+    Sensitive = $true
+    Value = @{
+        Provider = 'AzureKeyVault'
+        Vault = 'contoso-kv'
+        Name = 'app-setup-password'
+        UserName = 'CONTOSO\svc-app-setup'
+    }
+}
+
+FarmPassphrase = @{
+    Type = 'secureString'
+    Required = $true
+    Sensitive = $true
+    Value = @{
+        Provider = 'AzureKeyVault'
+        Vault = 'contoso-kv'
+        Name = 'farm-passphrase'
+    }
+}
+```
+
 Array values can be restricted item by item:
 
 ```powershell