[KeyVault] Upgrade control plane to API version 2026-02-01 - #30008
Open
Yash (notyashhh) wants to merge 3 commits into
Open
[KeyVault] Upgrade control plane to API version 2026-02-01#30008Yash (notyashhh) wants to merge 3 commits into
Yash (notyashhh) wants to merge 3 commits into
Conversation
Contributor
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Az.KeyVault module’s control-plane dependencies to target Key Vault API version 2026-02-01, including regenerating the embedded management SDK and updating the AutoRest config/docs to the new TypeSpec-emitted openapi.json.
Changes:
- Updated
Az.KeyVaultchangelog for the control-plane API version retirement timeline and expected user impact. - Regenerated
KeyVault.Management.Sdkfor2026-02-01and updated generator directives/config to keep surface area stable. - Updated
KeyVault.Autorestgenerator config and regenerated markdown help text to match updated parameter descriptions.
Reviewed changes
Copilot reviewed 6 out of 78 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| src/KeyVault/KeyVault/ChangeLog.md | Adds user-facing release note for the control-plane API version upgrade. |
| src/KeyVault/KeyVault.Management.Sdk/README.md | Updates spec input to TypeSpec-emitted openapi.json and adds/updates generator directives. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/PrivateLinkResourcesOperationsExtensions.cs | Regenerated XML docs for private link resources extensions. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/PrivateLinkResourcesOperations.cs | Regenerated private link resources operations implementation. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/PrivateEndpointConnectionsOperationsExtensions.cs | Regenerated private endpoint connections extension methods (list/get/put/delete). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/PrivateEndpointConnectionsOperations.cs | Regenerated private endpoint connections operations implementation. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/VaultPatchParameters.cs | Regenerated vault patch parameters model (base type changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/VaultCreateOrUpdateParameters.cs | Regenerated vault create/update parameters model (base type changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/VaultCheckNameAvailabilityParametersType.cs | Renames the generated enum/type used for name availability requests. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/VaultAccessPolicyParameters.cs | Regenerated vault access policy parameters model (base type changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/Vault.cs | Regenerated Vault model to use ARM base resource types (ProxyResource). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/TrackedResource.cs | Adds regenerated ARM TrackedResource base model. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/SystemData.cs | Regenerated SystemData model docs/shape to match ARM common type. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/Resource.cs | Regenerated ARM common Resource base model. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/Reason.cs | Regenerated reason constants/type for name availability results. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/ProxyResource.cs | Adds regenerated ARM ProxyResource base model. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/PrivateLinkResource.cs | Regenerated private link resource model to use ARM base resource types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/PrivateEndpointConnectionsPutHeaders.cs | Regenerated response headers type for private endpoint connection PUT. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/PrivateEndpointConnectionsDeleteHeaders.cs | Regenerated response headers type for private endpoint connection DELETE. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/PrivateEndpointConnectionProperties.cs | Regenerated PEC properties model (including setter/access changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/PrivateEndpointConnectionItem.cs | Regenerated PEC item model (including setter/access changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/PrivateEndpointConnection.cs | Regenerated PEC resource model to use ARM base resource types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/MhsmPrivateLinkResource.cs | Regenerated MHSM private link resource model to use ARM base resource types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/MhsmPrivateEndpointConnectionsPutHeaders.cs | Regenerated response headers type for MHSM private endpoint connection PUT. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/MhsmPrivateEndpointConnectionsDeleteHeaders.cs | Regenerated response headers type for MHSM private endpoint connection DELETE. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/MhsmPrivateEndpointConnectionProperties.cs | Regenerated MHSM PEC properties model (including setter/access changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/MhsmPrivateEndpointConnectionItem.cs | Regenerated MHSM PEC item model (including setter/access changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/MhsmPrivateEndpointConnection.cs | Regenerated MHSM PEC resource model to use ARM base resource types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/ManagedHsmsUpdateHeaders.cs | Regenerated LRO headers for managed HSM update. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/ManagedHsmsPurgeDeletedHeaders.cs | Regenerated LRO headers for managed HSM purge-deleted. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/ManagedHsmsDeleteHeaders.cs | Regenerated LRO headers for managed HSM delete. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/ManagedHsmsCreateOrUpdateHeaders.cs | Regenerated LRO headers for managed HSM create-or-update. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/ManagedHsmResource.cs | Removes the old ManagedHsmResource model (replaced by ARM base types). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/ManagedHsm.cs | Regenerated Managed HSM model to use ARM base resource types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/DeletedVault.cs | Regenerated deleted vault model to use ARM base resource types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/DeletedManagedHsm.cs | Regenerated deleted managed HSM model to use ARM base resource types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/CreatedByType.cs | Renames identity type constants to CreatedByType per ARM common types. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/CheckNameAvailabilityResult.cs | Regenerated name availability result model (reason type shape changes). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/Models/AccessPolicyEntry.cs | Minor regenerated docstring casing change. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/MHSMRegionsOperationsExtensions.cs | Regenerated MHSM regions extension docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/MHSMRegionsOperations.cs | Regenerated MHSM regions operations implementation. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/MHSMPrivateLinkResourcesOperationsExtensions.cs | Regenerated MHSM private link resources extension docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/MHSMPrivateLinkResourcesOperations.cs | Regenerated MHSM private link resources operations implementation. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/MHSMPrivateEndpointConnectionsOperationsExtensions.cs | Regenerated MHSM private endpoint connections extension docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/MHSMPrivateEndpointConnectionsOperations.cs | Regenerated MHSM private endpoint connections operations implementation. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/ManagedHsmsOperationsExtensions.cs | Regenerated managed HSM operations extension surface (ordering/docs). |
| src/KeyVault/KeyVault.Management.Sdk/Generated/KeyVaultManagementClient.cs | Bumps default ApiVersion and updates SubscriptionId type/docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IVaultsOperations.cs | Regenerated vaults operations interface ordering and signatures. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IPrivateLinkResourcesOperations.cs | Regenerated private link resources operations interface docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IPrivateEndpointConnectionsOperations.cs | Regenerated private endpoint connections operations interface ordering/docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IMHSMRegionsOperations.cs | Regenerated MHSM regions operations interface docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IMHSMPrivateLinkResourcesOperations.cs | Regenerated MHSM private link resources operations interface docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IMHSMPrivateEndpointConnectionsOperations.cs | Regenerated MHSM private endpoint connections operations interface docs. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IManagedHsmsOperations.cs | Regenerated managed HSM operations interface ordering and signatures. |
| src/KeyVault/KeyVault.Management.Sdk/Generated/IKeyVaultManagementClient.cs | Regenerated client interface (SubscriptionId type/docs and property ordering). |
| src/KeyVault/KeyVault.Autorest/README.md | Updates AutoRest config to TypeSpec-emitted openapi.json and adds stripping directives. |
| src/KeyVault/KeyVault.Autorest/docs/Test-AzKeyVaultNameAvailability.md | Regenerated help text for subscription parameter wording. |
| src/KeyVault/KeyVault.Autorest/docs/Test-AzKeyVaultManagedHsmNameAvailability.md | Regenerated help text for subscription parameter wording. |
| src/KeyVault/KeyVault.Autorest/docs/Get-AzKeyVaultManagedHsmRegion.md | Regenerated help text for updated parameter descriptions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+85
to
+92
| const sharedReason = $["Reason"]; | ||
| const mhsmResult = $["CheckMhsmNameAvailabilityResult"]; | ||
| if (sharedReason && mhsmResult && mhsmResult.properties && mhsmResult.properties.reason) { | ||
| const splitReason = Object.assign({}, sharedReason); | ||
| splitReason["x-ms-enum"] = Object.assign({}, sharedReason["x-ms-enum"], { name: "ReasonForCheckMhsmNameAvailabilityResult" }); | ||
| $["ReasonForCheckMhsmNameAvailabilityResult"] = splitReason; | ||
| mhsmResult.properties.reason["$ref"] = "#/definitions/ReasonForCheckMhsmNameAvailabilityResult"; | ||
| } |
| ## Upcoming Release | ||
| * Upgraded the Key Vault control plane API version to '2026-02-01'. | ||
| - All Key Vault control plane API versions before '2026-02-01' are being retired on 27 February 2027. Upgrading to a release that includes this change keeps 'Az.KeyVault' working past that date. | ||
| - No action is required and no cmdlet behavior changes. 'New-AzKeyVault' has created vaults with RBAC (Role-Based Access Control) enabled by default since Az.KeyVault 6.0.0, and it continues to send that setting explicitly, so the new service-side default has no effect on vaults created through this module. Use 'DisableRbacAuthorization' to create a vault that uses access policies instead. |
Comment on lines
41
to
+44
| /// <summary> | ||
| /// Subscription credentials which uniquely identify Microsoft Azure | ||
| /// subscription. The subscription ID forms part of the URI for every service | ||
| /// call. | ||
| /// The ID of the target subscription. The value must be an UUID. | ||
| /// </summary> | ||
| public string SubscriptionId { get; set;} | ||
| public System.Guid SubscriptionId { get; set;} |
Comment on lines
45
to
+48
| /// <summary> | ||
| /// Subscription credentials which uniquely identify Microsoft Azure | ||
| /// subscription. The subscription ID forms part of the URI for every service | ||
| /// call. | ||
| /// The ID of the target subscription. The value must be an UUID. | ||
| /// </summary> | ||
| string SubscriptionId { get; set;} | ||
| System.Guid SubscriptionId { get; set;} |
Comment on lines
129
to
132
| ### -SubscriptionId | ||
| Subscription credentials which uniquely identify Microsoft Azure subscription. | ||
| The subscription ID forms part of the URI for every service call. | ||
| The ID of the target subscription. | ||
| The value must be an UUID. | ||
|
|
Comment on lines
129
to
132
| ### -SubscriptionId | ||
| Subscription credentials which uniquely identify Microsoft Azure subscription. | ||
| The subscription ID forms part of the URI for every service call. | ||
| The ID of the target subscription. | ||
| The value must be an UUID. | ||
|
|
Comment on lines
88
to
91
| ### -SubscriptionId | ||
| Subscription credentials which uniquely identify Microsoft Azure subscription. | ||
| The subscription ID forms part of the URI for every service call. | ||
| The ID of the target subscription. | ||
| The value must be an UUID. | ||
|
|
Yash (notyashhh)
marked this pull request as ready for review
August 14, 2026 05:40
Contributor
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
Member
Author
|
/azp run |
Contributor
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 84 changed files in this pull request and generated no new comments.
Suppressed comments (3)
src/KeyVault/KeyVault/ChangeLog.md:23
- This changelog guidance references the parameter without the leading '-' (it reads like a property name rather than a switch). Since this is user-facing release notes, it should refer to the cmdlet parameter as '-DisableRbacAuthorization' to avoid confusion.
src/KeyVault/KeyVault.Management.Sdk/README.md:92 - The README says the directives keep the generated client identical to the 2025-05-01 baseline, but the generated models now expose
Reason/ReasonForCheckMhsmNameAvailabilityResultas string constants and theReasonproperties asstring(see Generated/Models/Reason.cs and CheckNameAvailabilityResult.cs). That’s a source-breaking SDK surface change compared to the previous enum-based model. Consider forcing these schemas to generate as enums (modelAsString=false) so the public model types and property types stay aligned with the baseline.
src/KeyVault/KeyVault.Test/ScenarioTests/ManagedHsmManagementTests.ps1:19 - This test file now hard-codes a specific subscription ID. Committing a real subscription GUID makes the repo less portable and can accidentally tie scenario runs to a personal/tenant subscription. Prefer keeping a placeholder value (or reading from an environment variable) so the guidance remains generic.
Member
Author
|
/azp run |
Contributor
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 84 changed files in this pull request and generated 3 comments.
Suppressed comments (5)
src/KeyVault/KeyVault/ChangeLog.md:23
- The changelog text refers to 'DisableRbacAuthorization' without the parameter dash, which can be confusing for users. This is a cmdlet switch parameter and should be written with a leading '-'.
src/KeyVault/KeyVault.Autorest/docs/Test-AzKeyVaultNameAvailability.md:131 - Grammar: 'an UUID' should be 'a UUID'.
### -SubscriptionId
The ID of the target subscription.
The value must be an UUID.
src/KeyVault/KeyVault.Autorest/docs/Test-AzKeyVaultManagedHsmNameAvailability.md:131
- Grammar: 'an UUID' should be 'a UUID'.
### -SubscriptionId
The ID of the target subscription.
The value must be an UUID.
src/KeyVault/KeyVault.Autorest/docs/Get-AzKeyVaultManagedHsmRegion.md:90
- Grammar: 'an UUID' should be 'a UUID'.
### -SubscriptionId
The ID of the target subscription.
The value must be an UUID.
src/KeyVault/KeyVault.Test/ScenarioTests/ManagedHsmManagementTests.ps1:20
- Hardcoded real-looking subscription ID was changed and is committed in the repo. This can leak internal subscription information and also makes the script non-portable for other developers/CI.
Comment on lines
41
to
45
| /// <summary> | ||
| /// Subscription credentials which uniquely identify Microsoft Azure | ||
| /// subscription. The subscription ID forms part of the URI for every service | ||
| /// call. | ||
| /// The ID of the target subscription. The value must be an UUID. | ||
| /// </summary> | ||
| public string SubscriptionId { get; set;} | ||
| public System.Guid SubscriptionId { get; set;} | ||
|
|
Comment on lines
62
to
+66
| /// Gets the reason that a vault name could not be used. The Reason element is | ||
| /// only returned if NameAvailable is false. Possible values include: 'AccountNameInvalid', 'AlreadyExists' | ||
| /// </summary> | ||
| [Newtonsoft.Json.JsonProperty(PropertyName = "reason")] | ||
| public Reason? Reason {get; private set; } | ||
| public string Reason {get; private set; } |
Comment on lines
10
to
+17
| /// Defines values for Reason. | ||
| /// </summary> | ||
|
|
||
|
|
||
| [Newtonsoft.Json.JsonConverter(typeof(Newtonsoft.Json.Converters.StringEnumConverter))] | ||
| public enum Reason | ||
| public static class Reason | ||
| { | ||
| [System.Runtime.Serialization.EnumMember(Value = "AccountNameInvalid")] | ||
| AccountNameInvalid, | ||
| [System.Runtime.Serialization.EnumMember(Value = "AlreadyExists")] | ||
| AlreadyExists | ||
| } | ||
| internal static class ReasonEnumExtension | ||
| { | ||
| internal static string ToSerializedValue(this Reason? value) | ||
| { | ||
| return value == null ? null : ((Reason)value).ToSerializedValue(); | ||
| } | ||
| internal static string ToSerializedValue(this Reason value) | ||
| { | ||
| switch( value ) | ||
| { | ||
| case Reason.AccountNameInvalid: | ||
| return "AccountNameInvalid"; | ||
| case Reason.AlreadyExists: | ||
| return "AlreadyExists"; | ||
| } | ||
| return null; | ||
| } | ||
| internal static Reason? ParseReason(this string value) | ||
| { | ||
| switch( value ) | ||
| { | ||
| case "AccountNameInvalid": | ||
| return Reason.AccountNameInvalid; | ||
| case "AlreadyExists": | ||
| return Reason.AlreadyExists; | ||
| } | ||
| return null; | ||
| } | ||
| public const string AccountNameInvalid = "AccountNameInvalid"; | ||
| public const string AlreadyExists = "AlreadyExists"; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Moves the
Az.KeyVaultcontrol plane onto API version2026-02-01.All Key Vault control plane API versions prior to
2026-02-01are being retired on 27 February 2027.Az.KeyVaultcurrently targets2025-05-01(SDK) and2024-11-01(AutoRest project), so without this change the module stops working at the deadline.Tracking: IcM 815108260 (Sev 3, retirement blocker, raised by EngOps CRE) · Azure CLI counterpart: Azure/azure-cli#33552 · Customer comms: RN3T-JRG
Is this a breaking change for users? No.
The only schema difference between
2025-05-01and2026-02-01is a single line:That is a service-side default for callers that omit the property.
New-AzKeyVaulthas always sent it explicitly:RBAC has been the default for vaults created by this module since Az.KeyVault 6.0.0 (May 2024), when
-EnableRbacAuthorizationwas replaced by-DisableRbacAuthorization. So the service-side flip is inert here, and no cmdlet behaviour changes. Users who want access policies continue to use-DisableRbacAuthorization.Key Vault migrated its specification to TypeSpec. The emitted document reorders operation parameters:
2025-05-01[name, location, ApiVersion, SubscriptionId]2026-02-01[ApiVersion, SubscriptionId, location, name]Regenerating naively flips six generated methods on both
VaultsandManagedHsms:Both parameters are
string, so existing call sites such asVaults.PurgeDeleted(vaultName, location)still compile with zero errors and zero warnings while sending the arguments the wrong way round. Captured live during test re-recording:Unfixed, this would have shipped
Get-AzKeyVault -InRemovedState,Remove-AzKeyVault -InRemovedStateand the Managed HSM equivalents broken. A clean build proved nothing; only running the tests against Azure surfaced it.Fixed with a generator directive that restores the original parameter order. Every generated operation signature now diffs to zero against the previous baseline.
Changes
KeyVault.Management.Sdk—2025-05-01->2026-02-01, regenerated from the TypeSpecopenapi.json(specs commit9f0ad696cc18).The single emitted document is broader than the three hand-written swagger files it replaced, so the generator config carries directives to keep the produced client identical apart from the version. Each one exists for a reason:
ManagedHsmKeycmdlets appearx-ms-enum.nameon the two constantVaults_Listquery parameters — TypeSpec drops them, regenerating asEnum24/Enum25ReasonForCheckMhsmNameAvailabilityResult— TypeSpec merges it into the sharedReasonenum, which would delete a public type from the shipped SDKVaults_CreateOrUpdate/Vaults_PurgeDeleted— they changeAzureOperationResponse<Vault>toAzureOperationResponse<Vault, THeaders>, a source breaking change for SDK consumers. The eight operations that already declared headers on2025-05-01are untouched.KeyVault.Autorest—2024-11-01->2026-02-01in the generator config. Exported cmdlets are unchanged (Add/Get/Remove-AzKeyVaultManagedHsmRegion,Test-AzKeyVaultNameAvailability,Test-AzKeyVaultManagedHsmNameAvailability). Docs regenerated for updated parameter descriptions.Net result: zero hand-written cmdlet code changed. Model delta is limited to ARM base-type renames (
IdentityType->CreatedByType,ManagedHsmResource->ProxyResource/TrackedResource,Type->VaultCheckNameAvailabilityParametersType).Testing
Playback: 129 passed -> 141 passed. Re-recorded against live Azure on
2026-02-01:KeyVaultManagementTests(8, includingTestDeleteVaultwhich proves the parameter-order fix)AccessPolicyTests,NetworkRuleTests(2),PrivateEndpointTestsManagedHsmManagementTests:TestManagedHsmCRUD,TestNewManagedHsmWithManagedServiceIdentityStill outstanding — see checklist below.
Pre-existing failures, unrelated to this change (no recordings exist in git; they fail on
maintoo):SecretManagementExtensionTests(2),OctHsmKeyTests(2).Remaining before this leaves draft
TestUndoManagedHsmRemovalandTestManagedHsmSoftDelete— these are the only live validation of theManagedHsmshalf of the parameter-order fixByokTests(fails on a data-plane DNS propagation race immediately after vault creation, not on this change)KeyVault.Autorestsource-side artifacts (help/,test/,custom/,UX/,AssemblyInfo.cs,generate-info.json)Notes for reviewers
generated/is intentionally untouched. That tree is maintained by the[skip ci] Archiveautomation, which regenerates it from the source-side config. Comparable API version PRs (Servicebus Servicebus 2026-01-01 cmdlets #29772, Eventhub Eventhub 2026-01-01 cmdlets #29788, CDN {CDN}Update with new api version 2026-04-01-preview #29817, ManagedNetworkFabric [skip ci] Archive 5262ee1f829c238ce8c3cb9f1e7f2ff2d3087ac2 #29872) all change 0 files there.The stale description in the specification. In
2026-02-01,enableRbacAuthorizationhas"default": truebut its description still reads "the vault is created with the default value of false". Contradictory in the shipped spec, and it is the exact property this retirement is about. Worth raising with the Key Vault team / REST API Board.Separate issue found while scanning the repo.
src/Network/Network/PrivateLinkService/PrivateLinkServiceProvider/ProviderConfiguration.cshardcodes Key Vault control plane versions used in live calls:These affect
Get/Set/Remove-AzPrivateEndpointConnectionandGet-AzPrivateLinkResourcewhen targeting a vault or managed HSM, and are in scope for the same retirement. Out of scope for this PR (different module and owners) but needs its own work item. Other modules are clear: onlysrc/KeyVaultconsumes the control plane SDK, andAz.CosmosDB'sAzure.Security.KeyVault.Keysreference is data plane, which is unaffected.Generator drift, not introduced here. Current
@autorest/powershell4.x no longer emits the per-cmdlet"No Azure login detected"guard. Regenerating any AutoRest module today drops it; the repo pins4.xwith no exact version.