I have just set this up. Here's what I did:
Created my key vault in Azure and put some secrets in it.
Restrict access to the key vault to know IP addresses, assigned access to my local IP and the IP address of the plesk server
Then created a service principal in AAD and created a key.
Then...