Azure DevOps self hosted agent uses wrong principal for connection to keyvault

I'm running a self-host ubuntu 20.04 Azure DevOps agent on my AKS cluster with Azure Workload Identity. In a job I have specified the following:

    - task: AzureKeyVault@2
      displayName: Get password
      inputs:
        azureSubscription: 'Azure Subscription'
        KeyVaultName: 'kv-pipeline'
        SecretsFilter: 'dev-postgress-admin-password'
        RunAsPreJob: false

The self-hosted agent doesn't use the 'azureSubscription' service principal connection to connect to the keyvault, but the AKS managed identity. I didn't expect this to happen. I would expect the self hosted agent to use the Azure Devops service principal.