enhance azure workload identity documentation (#2437)

Signed-off-by: Michael Ruoss <michael@michaelruoss.ch>

docs/provider/azure-key-vault.md

@@ -73,7 +73,7 @@ azwi serviceaccount create phase federated-identity \
 With these prerequisites met you can configure `ESO` to use that Service Account. You have two options:
 
 ##### Mounted Service Account
-You run the controller and mount that particular service account into the pod. That grants _everyone_ who is able to create a secret store or reference a correctly configured one the ability to read secrets. **This approach is usually not recommended**. But may make sense when you want to share an identity with multiple namespaces. Also see our [Multi-Tenancy Guide](../guides/multi-tenancy.md) for design considerations.
+You run the controller and mount that particular service account into the pod by adding the label `azure.workload.identity/use: "true"`to the pod. That grants _everyone_ who is able to create a secret store or reference a correctly configured one the ability to read secrets. **This approach is usually not recommended**. But may make sense when you want to share an identity with multiple namespaces. Also see our [Multi-Tenancy Guide](../guides/multi-tenancy.md) for design considerations.
 
 ```yaml
 {% include 'azkv-workload-identity-mounted.yaml' %}