Applications and Services deployed via the Azure Resource Model (ARM) each have their own Azure managed identity (see https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview) enabling secrets to be easily retrieved from Azure Key vault and enabling multi-tenant applications to run together in the same cluster without accessing to each other secrets.
Learn more about Azure Service Fabric.