How to configure Ansible with least-privilege Azure credentials for secure automation

Could you explain how to create a service principal with only the permissions needed for specific Azure resources, where to store its credentials safely (e.g., environment variables, Azure Key Vault, or restricted file permissions), how to configure Ansible to avoid logging secrets, and how to enforce least privilege on the control node itself? Please include considerations for using ansible.cfg to disable logging of variable values, setting file permissions on credential files, and limiting the Azure role assignments to the minimum required.