az keyvault

Manage KeyVault keys, secrets, and certificates.

Commands

az keyvault backup

Manage full HSM backup.

az keyvault backup start

Begin a full backup of the HSM.

az keyvault certificate

Manage certificates.

az keyvault certificate backup

Backs up the specified certificate.

az keyvault certificate contact

Manage contacts for certificate management.

az keyvault certificate contact add

Add a contact to the specified vault to receive notifications of certificate operations.

az keyvault certificate contact delete

Remove a certificate contact from the specified vault.

az keyvault certificate contact list

Lists the certificate contacts for a specified key vault.

az keyvault certificate create

Create a Key Vault certificate.

az keyvault certificate delete

Deletes a certificate from a specified key vault.

az keyvault certificate download

Download the public portion of a Key Vault certificate.

az keyvault certificate get-default-policy

Get the default policy for self-signed certificates.

az keyvault certificate import

Import a certificate into KeyVault.

az keyvault certificate issuer

Manage certificate issuer information.

az keyvault certificate issuer admin

Manage admin information for certificate issuers.

az keyvault certificate issuer admin add

Add admin details for a specified certificate issuer.

az keyvault certificate issuer admin delete

Remove admin details for the specified certificate issuer.

az keyvault certificate issuer admin list

List admins for a specified certificate issuer.

az keyvault certificate issuer create

Create a certificate issuer record.

az keyvault certificate issuer delete

Deletes the specified certificate issuer.

az keyvault certificate issuer list

List certificate issuers for a specified key vault.

az keyvault certificate issuer show

Lists the specified certificate issuer.

az keyvault certificate issuer update

Update a certificate issuer record.

az keyvault certificate list

List certificates in a specified key vault.

az keyvault certificate list-deleted

Lists the deleted certificates in the specified vault currently available for recovery.

az keyvault certificate list-versions

List the versions of a certificate.

az keyvault certificate pending

Manage pending certificate creation operations.

az keyvault certificate pending delete

Deletes the creation operation for a specific certificate.

az keyvault certificate pending merge

Merges a certificate or a certificate chain with a key pair existing on the server.

az keyvault certificate pending show

Gets the creation operation of a certificate.

az keyvault certificate purge

Permanently deletes the specified deleted certificate.

az keyvault certificate recover

Recovers the deleted certificate back to its current version under /certificates.

az keyvault certificate restore

Restores a backed up certificate to a vault.

az keyvault certificate set-attributes

Updates the specified attributes associated with the given certificate.

az keyvault certificate show

Gets information about a certificate.

az keyvault certificate show-deleted

Retrieves information about the specified deleted certificate.

az keyvault create

Create a Vault or HSM.

az keyvault delete

Delete a Vault or HSM.

az keyvault delete-policy

Delete security policy settings for a Key Vault.

az keyvault key

Manage keys.

az keyvault key backup

Request that a backup of the specified key be downloaded to the client.

az keyvault key create

Create a new key, stores it, then returns key parameters and attributes to the client.

az keyvault key decrypt

Decrypt a single block of encrypted data.

az keyvault key delete

Delete a key of any type from storage in Vault or HSM.

az keyvault key download

Download the public part of a stored key.

az keyvault key encrypt

Encrypt an arbitrary sequence of bytes using an encryption key that is stored in a Vault or HSM.

az keyvault key get-policy-template

Return policy template as JSON encoded policy definition.

az keyvault key import

Import a private key.

az keyvault key list

List keys in the specified Vault or HSM.

az keyvault key list-deleted

List the deleted keys in the specified Vault or HSM.

az keyvault key list-versions

Retrieves a list of individual key versions with the same key name.

az keyvault key purge

Permanently delete the specified key.

az keyvault key recover

Recover the deleted key to its latest version.

az keyvault key restore

Restore a backed up key to a Vault or HSM.

az keyvault key set-attributes

The update key operation changes specified attributes of a stored key and can be applied to any key type and key version stored in Vault or HSM.

az keyvault key show

Gets the public part of a stored key.

az keyvault key show-deleted

Get the public part of a deleted key.

az keyvault list

List Vaults and/or HSMs.

az keyvault list-deleted

Get information about the deleted Vaults or HSMs in a subscription.

az keyvault network-rule

Manage vault network ACLs.

az keyvault network-rule add

Add a network rule to the network ACLs for a Key Vault.

az keyvault network-rule list

List the network rules from the network ACLs for a Key Vault.

az keyvault network-rule remove

Remove a network rule from the network ACLs for a Key Vault.

az keyvault network-rule wait

Place the CLI in a waiting state until a condition of the vault is met.

az keyvault private-endpoint-connection

Manage vault private endpoint connections.

az keyvault private-endpoint-connection approve

Approve a private endpoint connection request for a Key Vault.

az keyvault private-endpoint-connection delete

Delete the specified private endpoint connection associated with a Key Vault.

az keyvault private-endpoint-connection reject

Reject a private endpoint connection request for a Key Vault.

az keyvault private-endpoint-connection show

Show details of a private endpoint connection associated with a Key Vault.

az keyvault private-endpoint-connection wait

Place the CLI in a waiting state until a condition of the private endpoint connection is met.

az keyvault private-link-resource

Manage vault private link resources.

az keyvault private-link-resource list

List the private link resources supported for a Key Vault.

az keyvault purge

Permanently delete the specified Vault or HSM. Aka Purges the deleted Vault or HSM.

az keyvault recover

Recover a Vault or HSM.

az keyvault restore

Manage full HSM restore.

az keyvault restore start

Restore a full backup of a HSM.

az keyvault role

Manage user roles for access control.

az keyvault role assignment

Manage role assignments.

az keyvault role assignment create

Create a new role assignment for a user, group, or service principal.

az keyvault role assignment delete

Delete a role assignment.

az keyvault role assignment list

List role assignments.

az keyvault role definition

Manage role definitions.

az keyvault role definition list

List role definitions.

az keyvault secret

Manage secrets.

az keyvault secret backup

Backs up the specified secret.

az keyvault secret delete

Deletes a secret from a specified key vault.

az keyvault secret download

Download a secret from a KeyVault.

az keyvault secret list

List secrets in a specified key vault.

az keyvault secret list-deleted

Lists deleted secrets for the specified vault.

az keyvault secret list-versions

List all versions of the specified secret.

az keyvault secret purge

Permanently deletes the specified secret.

az keyvault secret recover

Recovers the deleted secret to the latest version.

az keyvault secret restore

Restores a backed up secret to a vault.

az keyvault secret set

Create a secret (if one doesn't exist) or update a secret in a KeyVault.

az keyvault secret set-attributes

Updates the attributes associated with a specified secret in a given key vault.

az keyvault secret show

Get a specified secret from a given key vault.

az keyvault secret show-deleted

Gets the specified deleted secret.

az keyvault security-domain

Manage security domain operations.

az keyvault security-domain download

Download the security domain file from the HSM.

az keyvault security-domain init-recovery

Retrieve the exchange key of the HSM.

az keyvault security-domain upload

Start to restore the HSM.

az keyvault security-domain wait

Place the CLI in a waiting state until HSM security domain operation is finished.

az keyvault set-policy

Update security policy settings for a Key Vault.

az keyvault show

Show details of a Vault or HSM.

az keyvault storage

Manage storage accounts.

az keyvault storage add

Creates or updates a new storage account.

az keyvault storage backup

Backs up the specified storage account.

az keyvault storage list

List storage accounts managed by the specified key vault.

az keyvault storage list-deleted

Lists deleted storage accounts for the specified vault.

az keyvault storage purge

Permanently deletes the specified storage account.

az keyvault storage recover

Recovers the deleted storage account.

az keyvault storage regenerate-key

Regenerates the specified key value for the given storage account.

az keyvault storage remove

Remove a Key Vault managed Azure Storage Account and all associated SAS definitions. This operation requires the storage/delete permission.

az keyvault storage restore

Restores a backed up storage account to a vault.

az keyvault storage sas-definition

Manage storage account SAS definitions.

az keyvault storage sas-definition create

Creates or updates a new SAS definition for the specified storage account.

az keyvault storage sas-definition delete

Deletes a SAS definition from a specified storage account.

az keyvault storage sas-definition list

List storage SAS definitions for the given storage account.

az keyvault storage sas-definition list-deleted

Lists deleted SAS definitions for the specified vault and storage account.

az keyvault storage sas-definition recover

Recovers the deleted SAS definition.

az keyvault storage sas-definition show

Gets information about a SAS definition for the specified storage account.

az keyvault storage sas-definition show-deleted

Gets the specified deleted sas definition.

az keyvault storage sas-definition update

Updates the specified attributes associated with the given SAS definition.

az keyvault storage show

Gets information about a specified storage account.

az keyvault storage show-deleted

Gets the specified deleted storage account.

az keyvault storage update

Updates the specified attributes associated with the given storage account.

az keyvault update

Update the properties of a Vault.

az keyvault update-hsm

Update the properties of a HSM.

az keyvault wait

Place the CLI in a waiting state until a condition of the Vault is met.

az keyvault wait-hsm

Place the CLI in a waiting state until a condition of the HSM is met.

az keyvault create

Create a Vault or HSM.

If --enable-rbac-authorization is not specified, then default permissions are created for the current user or service principal unless the --no-self-perms flag is specified.

az keyvault create --resource-group
                   [--administrators]
                   [--bypass {AzureServices, None}]
                   [--default-action {Allow, Deny}]
                   [--enable-purge-protection {false, true}]
                   [--enable-rbac-authorization {false, true}]
                   [--enable-soft-delete {false, true}]
                   [--enabled-for-deployment {false, true}]
                   [--enabled-for-disk-encryption {false, true}]
                   [--enabled-for-template-deployment {false, true}]
                   [--hsm-name]
                   [--location]
                   [--name]
                   [--network-acls]
                   [--network-acls-ips]
                   [--network-acls-vnets]
                   [--no-self-perms {false, true}]
                   [--no-wait]
                   [--retention-days]
                   [--sku]
                   [--subscription]
                   [--tags]

Examples

Create a key vault with network ACLs specified (use --network-acls to specify IP and VNet rules by using a JSON string).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls "{\"ip\": [\"1.2.3.4\", \"2.3.4.0/24\"], \"vnet\": [\"vnet_name_1/subnet_name1\", \"vnet_name_2/subnet_name2\", \"/subscriptions/000000-0000-0000/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/MyVNet/subnets/MySubnet\"]}"

Create a key vault with network ACLs specified (use --network-acls to specify IP and VNet rules by using a JSON file).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls network-acls-example.json

Create a key vault with network ACLs specified (use --network-acls-ips to specify IP rules).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls-ips 3.4.5.0/24 4.5.6.0/24

Create a key vault with network ACLs specified (use --network-acls-vnets to specify VNet rules).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls-vnets vnet_name_2/subnet_name_2 vnet_name_3/subnet_name_3 /subscriptions/000000-0000-0000/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/vnet_name_4/subnets/subnet_name_4

Create a key vault with network ACLs specified (use --network-acls, --network-acls-ips and --network-acls-vnets together, redundant rules will be removed, finally there will be 4 IP rules and 3 VNet rules).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls "{\"ip\": [\"1.2.3.4\", \"2.3.4.0/24\"], \"vnet\": [\"vnet_name_1/subnet_name1\", \"vnet_name_2/subnet_name2\"]}" --network-acls-ips 3.4.5.0/24 4.5.6.0/24 --network-acls-vnets vnet_name_2/subnet_name_2 vnet_name_3/subnet_name_3 /subscriptions/000000-0000-0000/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/vnet_name_4/subnets/subnet_name_4

Create a key vault. (autogenerated)

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup

Required Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--administrators

[HSM Only] Administrator role for data plane operations for Managed HSM. It accepts a space separated list of OIDs that will be assigned.

--bypass

Bypass traffic for space-separated uses.

accepted values: AzureServices, None
--default-action

Default action to apply when no rule matches.

accepted values: Allow, Deny
--enable-purge-protection

Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.

accepted values: false, true
--enable-rbac-authorization

Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored (warning: this is a preview feature). When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.

accepted values: false, true
--enable-soft-delete

[Vault Only] Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value (true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.

accepted values: false, true
--enabled-for-deployment

[Vault Only] Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.

accepted values: false, true
--enabled-for-disk-encryption

[Vault Only] Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.

accepted values: false, true
--enabled-for-template-deployment

[Vault Only] Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.

accepted values: false, true
--hsm-name

Name of the HSM. (--hsm-name and --name/-n are mutually exclusive, please specify just one of them).

--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

--name -n

Name of the Vault.

--network-acls

Network ACLs. It accepts a JSON filename or a JSON string. JSON format: {"ip":[<ip1>, <ip2>...],"vnet":[<vnet_name_1>/<subnet_name_1>,<subnet_id2>...]}.

--network-acls-ips

Network ACLs IP rules. Space-separated list of IP addresses.

--network-acls-vnets

Network ACLS VNet rules. Space-separated list of Vnet/subnet pairs or subnet resource ids.

--no-self-perms

[Vault Only] Don't add permissions for the current user/service principal in the new vault.

accepted values: false, true
--no-wait

Do not wait for the long-running operation to finish.

--retention-days

Soft delete data retention days. It accepts >=7 and <=90.

default value: 90
--sku

Required. SKU details. Allowed values for Vault: premium, standard. Default: standard. Allowed values for HSM: Standard_B1, Custom_B32. Default: Standard_B1.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

az keyvault delete

Delete a Vault or HSM.

az keyvault delete [--hsm-name]
                   [--name]
                   [--no-wait]
                   [--resource-group]
                   [--subscription]

Examples

Delete a key vault. (autogenerated)

az keyvault delete --name MyKeyVault --resource-group MyResourceGroup

Optional Parameters

--hsm-name

Name of the HSM. (--hsm-name and --name/-n are mutually exclusive, please specify just one of them).

--name -n

Name of the Vault.

--no-wait

Do not wait for the long-running operation to finish.

--resource-group -g

Proceed only if Key Vault belongs to the specified resource group.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault delete-policy

Delete security policy settings for a Key Vault.

az keyvault delete-policy --name
                          [--no-wait]
                          [--object-id]
                          [--resource-group]
                          [--spn]
                          [--subscription]
                          [--upn]

Required Parameters

--name -n

Name of the Vault.

Optional Parameters

--no-wait

Do not wait for the long-running operation to finish.

--object-id

A GUID that identifies the principal that will receive permissions.

--resource-group -g

Proceed only if Key Vault belongs to the specified resource group.

--spn

Name of a service principal that will receive permissions.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--upn

Name of a user principal that will receive permissions.

az keyvault list

List Vaults and/or HSMs.

az keyvault list [--query-examples]
                 [--resource-group]
                 [--resource-type]
                 [--subscription]

Optional Parameters

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-type

When --resource-type is not present the command will list all Vaults and HSMs. Possible values for --resource-type are vault and hsm.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault list-deleted

Get information about the deleted Vaults or HSMs in a subscription.

az keyvault list-deleted [--resource-type]
                         [--subscription]

Optional Parameters

--resource-type

When --resource-type is not present the command will list all deleted Vaults and HSMs. Possible values for --resource-type are vault and hsm.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault purge

Permanently delete the specified Vault or HSM. Aka Purges the deleted Vault or HSM.

az keyvault purge [--hsm-name]
                  [--location]
                  [--name]
                  [--no-wait]
                  [--subscription]

Optional Parameters

--hsm-name

Name of the deleted HSM. (--hsm-name and --name/-n are mutually exclusive, please specify just one of them).

--location -l

Location of the deleted Vault or HSM.

--name -n

Name of the deleted Vault.

--no-wait

Do not wait for the long-running operation to finish.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault recover

Recover a Vault or HSM.

Recover a previously deleted Vault or HSM for which soft delete was enabled.

az keyvault recover [--hsm-name]
                    [--location]
                    [--name]
                    [--no-wait]
                    [--resource-group]
                    [--subscription]

Examples

Recover a key vault. (autogenerated)

az keyvault recover --location westus2 --name MyKeyVault --resource-group MyResourceGroup

Optional Parameters

--hsm-name

Name of the deleted HSM. (--hsm-name and --name/-n are mutually exclusive, please specify just one of them).

--location -l

Location of the deleted Vault or HSM.

--name -n

Name of the deleted Vault.

--no-wait

Do not wait for the long-running operation to finish.

--resource-group -g

Resource group of the deleted Vault or HSM.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault set-policy

Update security policy settings for a Key Vault.

az keyvault set-policy --name
                       [--certificate-permissions {backup, create, delete, deleteissuers, get, getissuers, import, list, listissuers, managecontacts, manageissuers, purge, recover, restore, setissuers, update}]
                       [--key-permissions {backup, create, decrypt, delete, encrypt, get, import, list, purge, recover, restore, sign, unwrapKey, update, verify, wrapKey}]
                       [--no-wait]
                       [--object-id]
                       [--resource-group]
                       [--secret-permissions {backup, delete, get, list, purge, recover, restore, set}]
                       [--spn]
                       [--storage-permissions {backup, delete, deletesas, get, getsas, list, listsas, purge, recover, regeneratekey, restore, set, setsas, update}]
                       [--subscription]
                       [--upn]

Required Parameters

--name -n

Name of the Vault.

Optional Parameters

--certificate-permissions

Space-separated list of certificate permissions to assign.

accepted values: backup, create, delete, deleteissuers, get, getissuers, import, list, listissuers, managecontacts, manageissuers, purge, recover, restore, setissuers, update
--key-permissions

Space-separated list of key permissions to assign.

accepted values: backup, create, decrypt, delete, encrypt, get, import, list, purge, recover, restore, sign, unwrapKey, update, verify, wrapKey
--no-wait

Do not wait for the long-running operation to finish.

--object-id

A GUID that identifies the principal that will receive permissions.

--resource-group -g

Proceed only if Key Vault belongs to the specified resource group.

--secret-permissions

Space-separated list of secret permissions to assign.

accepted values: backup, delete, get, list, purge, recover, restore, set
--spn

Name of a service principal that will receive permissions.

--storage-permissions

Space-separated list of storage permissions to assign.

accepted values: backup, delete, deletesas, get, getsas, list, listsas, purge, recover, regeneratekey, restore, set, setsas, update
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--upn

Name of a user principal that will receive permissions.

az keyvault show

Show details of a Vault or HSM.

az keyvault show [--hsm-name]
                 [--name]
                 [--query-examples]
                 [--resource-group]
                 [--subscription]

Examples

Show details of a key vault. (autogenerated)

az keyvault show --name MyKeyVault

Optional Parameters

--hsm-name

Name of the HSM. (--hsm-name and --name/-n are mutually exclusive, please specify just one of them).

--name -n

Name of the Vault.

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--resource-group -g

Proceed only if Key Vault belongs to the specified resource group.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault update

Update the properties of a Vault.

az keyvault update --name
                   [--add]
                   [--bypass {AzureServices, None}]
                   [--default-action {Allow, Deny}]
                   [--enable-purge-protection {false, true}]
                   [--enable-rbac-authorization {false, true}]
                   [--enable-soft-delete {false, true}]
                   [--enabled-for-deployment {false, true}]
                   [--enabled-for-disk-encryption {false, true}]
                   [--enabled-for-template-deployment {false, true}]
                   [--force-string]
                   [--no-wait]
                   [--remove]
                   [--resource-group]
                   [--retention-days]
                   [--set]
                   [--subscription]

Examples

Update the properties of a Vault. (autogenerated)

az keyvault update --enabled-for-disk-encryption true --name MyKeyVault --resource-group MyResourceGroup

Required Parameters

--name -n

Name of the Vault.

Optional Parameters

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

--bypass

Bypass traffic for space-separated uses.

accepted values: AzureServices, None
--default-action

Default action to apply when no rule matches.

accepted values: Allow, Deny
--enable-purge-protection

Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.

accepted values: false, true
--enable-rbac-authorization

Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored (warning: this is a preview feature). When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.

accepted values: false, true
--enable-soft-delete

[Vault Only] Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value (true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.

accepted values: false, true
--enabled-for-deployment

[Vault Only] Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.

accepted values: false, true
--enabled-for-disk-encryption

[Vault Only] Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.

accepted values: false, true
--enabled-for-template-deployment

[Vault Only] Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.

accepted values: false, true
--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

--no-wait

Do not wait for the long-running operation to finish.

--remove

Remove a property or an element from a list. Example: --remove property.list OR --remove propertyToRemove.

--resource-group -g

Proceed only if Key Vault belongs to the specified resource group.

--retention-days

Soft delete data retention days. It accepts >=7 and <=90.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault update-hsm

Update the properties of a HSM.

az keyvault update-hsm --hsm-name
                       [--add]
                       [--bypass {AzureServices, None}]
                       [--default-action {Allow, Deny}]
                       [--enable-purge-protection {false, true}]
                       [--force-string]
                       [--no-wait]
                       [--remove]
                       [--resource-group]
                       [--secondary-locations]
                       [--set]
                       [--subscription]

Examples

Update the properties of a HSM.

az keyvault update-hsm --enable-purge-protection true --hsm-name MyHSM --resource-group MyResourceGroup

Required Parameters

--hsm-name

Name of the HSM.

Optional Parameters

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

--bypass

Bypass traffic for space-separated uses.

accepted values: AzureServices, None
--default-action

Default action to apply when no rule matches.

accepted values: Allow, Deny
--enable-purge-protection -e

Property specifying whether protection against purge is enabled for this managed HSM pool. Setting this property to true activates protection against purge for this managed HSM pool and its content - only the Managed HSM service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible.

accepted values: false, true
--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

--no-wait

Do not wait for the long-running operation to finish.

--remove

Remove a property or an element from a list. Example: --remove property.list OR --remove propertyToRemove.

--resource-group -g

Proceed only if Key Vault belongs to the specified resource group.

--secondary-locations

--secondary-locations extends/contracts an HSM pool to listed regions. The primary location where the resource was originally created CANNOT be removed.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault wait

Place the CLI in a waiting state until a condition of the Vault is met.

az keyvault wait --name
                 [--created]
                 [--custom]
                 [--deleted]
                 [--exists]
                 [--interval]
                 [--resource-group]
                 [--subscription]
                 [--timeout]
                 [--updated]

Examples

Pause CLI until the vault is created.

az keyvault wait --name MyVault --created

Required Parameters

--name -n

Name of the Vault.

Optional Parameters

--created

Wait until created with 'provisioningState' at 'Succeeded'.

--custom

Wait until the condition satisfies a custom JMESPath query. E.g. provisioningState!='InProgress', instanceView.statuses[?code=='PowerState/running'].

--deleted

Wait until deleted.

--exists

Wait until the resource exists.

--interval

Polling interval in seconds.

default value: 30
--resource-group -g

Proceed only if Key Vault belongs to the specified resource group.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--timeout

Maximum wait in seconds.

default value: 3600
--updated

Wait until updated with provisioningState at 'Succeeded'.

az keyvault wait-hsm

Place the CLI in a waiting state until a condition of the HSM is met.

az keyvault wait-hsm --hsm-name
                     [--created]
                     [--custom]
                     [--deleted]
                     [--exists]
                     [--interval]
                     [--resource-group]
                     [--subscription]
                     [--timeout]
                     [--updated]

Examples

Pause CLI until the HSM is created.

az keyvault wait-hsm --hsm-name MyHSM --created

Required Parameters

--hsm-name

Name of the HSM.

Optional Parameters

--created

Wait until created with 'provisioningState' at 'Succeeded'.

--custom

Wait until the condition satisfies a custom JMESPath query. E.g. provisioningState!='InProgress', instanceView.statuses[?code=='PowerState/running'].

--deleted

Wait until deleted.

--exists

Wait until the resource exists.

--interval

Polling interval in seconds.

default value: 30
--resource-group -g

Proceed only if HSM belongs to the specified resource group.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--timeout

Maximum wait in seconds.

default value: 3600
--updated

Wait until updated with provisioningState at 'Succeeded'.