Reference secret from Azure Key Vault

Currently, as I see it, there istwo ways of referencing secrets:

1. by using @ @Microsoft.KeyVault(...), or
2. directly, having fx a secret named secret in the vault, and then reference it directly

For 2) i have this extra in my Program.cs

 .ConfigureAppConfiguration((context, config) =>
             {
                 //Only for use when running in a VM, else remove this
                 var builtConfig = config.Build();
                 var azureServiceTokenProvider = new AzureServiceTokenProvider();
                 var keyVaultClient = new KeyVaultClient(
                     new KeyVaultClient.AuthenticationCallback(
                         azureServiceTokenProvider.KeyVaultTokenCallback));
                 config.AddAzureKeyVault(
                     $"https://{builtConfig["KeyVaultName"]}.vault.azure.net/",
                     keyVaultClient,
                     new DefaultKeyVaultSecretManager());
             })

When do I use what? Is the @ notation for use when you either:

1. have an Azure Function, or
2. a configuring an already running application, and adding a Key Vault to the stack

I have a hard time seeing when to use what.