async def METHOD_NAME():
    MANAGED_HSM_URL = os.environ["MANAGED_HSM_URL"]
    # Instantiate an access control client that will be used to call the service.
    # Here we use the DefaultAzureCredential, but any azure-identity credential can be used.
    credential = DefaultAzureCredential()
    client = KeyVaultAccessControlClient(vault_url=MANAGED_HSM_URL, credential=credential)
    # Let's first create a custom role definition. This role permits creating keys in a Managed HSM.
    # We'll provide a friendly role name, and let a unique role definition name (a GUID) be generated for us.
    print("\n.. Create a role definition")
    role_name = "customRole"
    scope = KeyVaultRoleScope.GLOBAL
    permissions = [KeyVaultPermission(data_actions=[KeyVaultDataAction.CREATE_HSM_KEY])]
    role_definition = await client.set_role_definition(scope=scope, role_name=role_name, permissions=permissions)
    print(f"Role definition '{role_definition.role_name}' created successfully.")
    # Let's update our role definition to allow reading keys, but not allow creating keys.
    # To update an existing definition, pass the name keyword argument to set_role_definition. This is the unique
    # name of the role definition, which is stored in KeyVaultRoleDefinition.name.
    print("\n.. Update a role definition")
    new_permissions = [
        KeyVaultPermission(
            data_actions=[KeyVaultDataAction.READ_HSM_KEY],
            not_data_actions=[KeyVaultDataAction.CREATE_HSM_KEY]
        )
    ]
    unique_definition_name = role_definition.name
    updated_definition = await client.set_role_definition(
        scope=scope, name=unique_definition_name, role_name=role_name, permissions=new_permissions
    )
    print(f"Role definition '{updated_definition.role_name}' updated successfully.")
    # Now let's create a role assignment to apply our role definition to our service principal.
    # Since we don't provide the name keyword argument to create_role_definition, a unique role assignment name
    # (a GUID) is generated for us.
    print("\n.. Create a role assignment")
    principal_id = os.environ["AZURE_CLIENT_ID"]
    definition_id = updated_definition.id
    role_assignment = await client.create_role_assignment(
        scope=scope, definition_id=definition_id, principal_id=principal_id
    )
    print("Role assignment created successfully.")
    # Let's delete the role assignment.
    print("\n.. Delete a role assignment")
    await client.delete_role_assignment(scope=scope, name=role_assignment.name)
    print("Role assignment deleted successfully.")
    # Finally, let's delete the role definition as well.
    print("\n.. Delete a role definition")
    await client.delete_role_definition(scope=scope, name=definition_id)
    print("Role definition deleted successfully.")
    await credential.close()
    await client.close()