az keyvault

Commands

az keyvault backup	Manage full HSM backup.
az keyvault backup start	Begin a full backup of the HSM.
az keyvault certificate	Manage certificates.
az keyvault certificate backup	Backs up the specified certificate.
az keyvault certificate contact	Manage contacts for certificate management.
az keyvault certificate contact add	Add a contact to the specified vault to receive notifications of certificate operations.
az keyvault certificate contact delete	Remove a certificate contact from the specified vault.
az keyvault certificate contact list	Lists the certificate contacts for a specified key vault.
az keyvault certificate create	Create a Key Vault certificate.
az keyvault certificate delete	Deletes a certificate from a specified key vault.
az keyvault certificate download	Download the public portion of a Key Vault certificate.
az keyvault certificate get-default-policy	Get the default policy for self-signed certificates.
az keyvault certificate import	Import a certificate into KeyVault.
az keyvault certificate issuer	Manage certificate issuer information.
az keyvault certificate issuer admin	Manage admin information for certificate issuers.
az keyvault certificate issuer admin add	Add admin details for a specified certificate issuer.
az keyvault certificate issuer admin delete	Remove admin details for the specified certificate issuer.
az keyvault certificate issuer admin list	List admins for a specified certificate issuer.
az keyvault certificate issuer create	Create a certificate issuer record.
az keyvault certificate issuer delete	Deletes the specified certificate issuer.
az keyvault certificate issuer list	List certificate issuers for a specified key vault.
az keyvault certificate issuer show	Lists the specified certificate issuer.
az keyvault certificate issuer update	Update a certificate issuer record.
az keyvault certificate list	List certificates in a specified key vault.
az keyvault certificate list-deleted	Lists the deleted certificates in the specified vault currently available for recovery.
az keyvault certificate list-versions	List the versions of a certificate.
az keyvault certificate pending	Manage pending certificate creation operations.
az keyvault certificate pending delete	Deletes the creation operation for a specific certificate.
az keyvault certificate pending merge	Merges a certificate or a certificate chain with a key pair existing on the server.
az keyvault certificate pending show	Gets the creation operation of a certificate.
az keyvault certificate purge	Permanently deletes the specified deleted certificate.
az keyvault certificate recover	Recovers the deleted certificate back to its current version under /certificates.
az keyvault certificate restore	Restores a backed up certificate to a vault.
az keyvault certificate set-attributes	Updates the specified attributes associated with the given certificate.
az keyvault certificate show	Gets information about a certificate.
az keyvault certificate show-deleted	Retrieves information about the specified deleted certificate.
az keyvault check-name	Checks that the managed hsm name is valid and is not already in use.
az keyvault create	Create a Vault or HSM.
az keyvault delete	Delete a Vault or HSM.
az keyvault delete-policy	Delete security policy settings for a Key Vault.
az keyvault key	Manage keys.
az keyvault key backup	Request that a backup of the specified key be downloaded to the client.
az keyvault key create	Create a new key, stores it, then returns key parameters and attributes to the client.
az keyvault key decrypt	Decrypt a single block of encrypted data.
az keyvault key delete	Delete a key of any type from storage in Vault or HSM.
az keyvault key download	Download the public part of a stored key.
az keyvault key encrypt	Encrypt an arbitrary sequence of bytes using an encryption key that is stored in a Vault or HSM.
az keyvault key get-policy-template	Return policy template as JSON encoded policy definition.
az keyvault key import	Import a private key.
az keyvault key list	List keys in the specified Vault or HSM.
az keyvault key list-deleted	List the deleted keys in the specified Vault or HSM.
az keyvault key list-versions	Retrieves a list of individual key versions with the same key name.
az keyvault key purge	Permanently delete the specified key.
az keyvault key random	Get the requested number of random bytes from a managed HSM.
az keyvault key recover	Recover the deleted key to its latest version.
az keyvault key restore	Restore a backed up key to a Vault or HSM.
az keyvault key rotate	Rotate the key based on the key policy by generating a new version of the key.
az keyvault key rotation-policy	Manage key's rotation policy.
az keyvault key rotation-policy show	Get the rotation policy of a Key Vault key.
az keyvault key rotation-policy update	Update the rotation policy of a Key Vault key.
az keyvault key set-attributes	The update key operation changes specified attributes of a stored key and can be applied to any key type and key version stored in Vault or HSM.
az keyvault key show	Get a key's attributes and, if it's an asymmetric key, its public material.
az keyvault key show-deleted	Get the public part of a deleted key.
az keyvault list	List Vaults and/or HSMs.
az keyvault list-deleted	Get information about the deleted Vaults or HSMs in a subscription.
az keyvault network-rule	Manage vault network ACLs.
az keyvault network-rule add	Add a network rule to the network ACLs for a Key Vault.
az keyvault network-rule list	List the network rules from the network ACLs for a Key Vault.
az keyvault network-rule remove	Remove a network rule from the network ACLs for a Key Vault.
az keyvault network-rule wait	Place the CLI in a waiting state until a condition of the vault is met.
az keyvault private-endpoint-connection	Manage vault/HSM private endpoint connections.
az keyvault private-endpoint-connection approve	Approve a private endpoint connection request for a Key Vault/HSM.
az keyvault private-endpoint-connection delete	Delete the specified private endpoint connection associated with a Key Vault/HSM.
az keyvault private-endpoint-connection list	List all private endpoint connections associated with a HSM.
az keyvault private-endpoint-connection reject	Reject a private endpoint connection request for a Key Vault/HSM.
az keyvault private-endpoint-connection show	Show details of a private endpoint connection associated with a Key Vault/HSM.
az keyvault private-endpoint-connection wait	Place the CLI in a waiting state until a condition of the private endpoint connection is met.
az keyvault private-link-resource	Manage vault/HSM private link resources.
az keyvault private-link-resource list	List the private link resources supported for a Key Vault/HSM.
az keyvault purge	Permanently delete the specified Vault or HSM. Aka Purges the deleted Vault or HSM.
az keyvault recover	Recover a Vault or HSM.
az keyvault region	Manage MHSM multi-regions.
az keyvault region add	Add regions for the managed HSM Pool.
az keyvault region list	Get regions information associated with the managed HSM Pool.
az keyvault region remove	Remove regions for the managed HSM Pool.
az keyvault region wait	Place the CLI in a waiting state until a condition of the HSM is met.
az keyvault restore	Manage full HSM restore.
az keyvault restore start	Restore a full backup of a HSM.
az keyvault role	Manage user roles for access control.
az keyvault role assignment	Manage role assignments.
az keyvault role assignment create	Create a new role assignment for a user, group, or service principal.
az keyvault role assignment delete	Delete a role assignment.
az keyvault role assignment list	List role assignments.
az keyvault role definition	Manage role definitions.
az keyvault role definition create	Create a custom role definition.
az keyvault role definition delete	Delete a role definition.
az keyvault role definition list	List role definitions.
az keyvault role definition show	Show the details of a role definition.
az keyvault role definition update	Update a role definition.
az keyvault secret	Manage secrets.
az keyvault secret backup	Backs up the specified secret.
az keyvault secret delete	Deletes a secret from a specified key vault.
az keyvault secret download	Download a secret from a KeyVault.
az keyvault secret list	List secrets in a specified key vault.
az keyvault secret list-deleted	Lists deleted secrets for the specified vault.
az keyvault secret list-versions	List all versions of the specified secret.
az keyvault secret purge	Permanently deletes the specified secret.
az keyvault secret recover	Recovers the deleted secret to the latest version.
az keyvault secret restore	Restores a backed up secret to a vault.
az keyvault secret set	Create a secret (if one doesn't exist) or update a secret in a KeyVault.
az keyvault secret set-attributes	Updates the attributes associated with a specified secret in a given key vault.
az keyvault secret show	Get a specified secret from a given key vault.
az keyvault secret show-deleted	Gets the specified deleted secret.
az keyvault security-domain	Manage security domain operations.
az keyvault security-domain download	Download the security domain file from the HSM.
az keyvault security-domain init-recovery	Retrieve the exchange key of the HSM.
az keyvault security-domain restore-blob	Enable to decrypt and encrypt security domain file as blob. Can be run in offline environment, before file is uploaded to HSM using security-domain upload.
az keyvault security-domain upload	Start to restore the HSM.
az keyvault security-domain wait	Place the CLI in a waiting state until HSM security domain operation is finished.
az keyvault set-policy	Update security policy settings for a Key Vault.
az keyvault show	Show details of a Vault or HSM.
az keyvault show-deleted	Show details of a deleted Vault or HSM.
az keyvault storage	Manage storage accounts.
az keyvault storage add	Creates or updates a new storage account.
az keyvault storage backup	Backs up the specified storage account.
az keyvault storage list	List storage accounts managed by the specified key vault.
az keyvault storage list-deleted	Lists deleted storage accounts for the specified vault.
az keyvault storage purge	Permanently deletes the specified storage account.
az keyvault storage recover	Recovers the deleted storage account.
az keyvault storage regenerate-key	Regenerates the specified key value for the given storage account.
az keyvault storage remove	Remove a Key Vault managed Azure Storage Account and all associated SAS definitions. This operation requires the storage/delete permission.
az keyvault storage restore	Restores a backed up storage account to a vault.
az keyvault storage sas-definition	Manage storage account SAS definitions.
az keyvault storage sas-definition create	Creates or updates a new SAS definition for the specified storage account.
az keyvault storage sas-definition delete	Deletes a SAS definition from a specified storage account.
az keyvault storage sas-definition list	List storage SAS definitions for the given storage account.
az keyvault storage sas-definition list-deleted	Lists deleted SAS definitions for the specified vault and storage account.
az keyvault storage sas-definition recover	Recovers the deleted SAS definition.
az keyvault storage sas-definition show	Gets information about a SAS definition for the specified storage account.
az keyvault storage sas-definition show-deleted	Gets the specified deleted sas definition.
az keyvault storage sas-definition update	Updates the specified attributes associated with the given SAS definition.
az keyvault storage show	Gets information about a specified storage account.
az keyvault storage show-deleted	Gets the specified deleted storage account.
az keyvault storage update	Updates the specified attributes associated with the given storage account.
az keyvault update	Update the properties of a Vault.
az keyvault update-hsm	Update the properties of a HSM.
az keyvault wait	Place the CLI in a waiting state until a condition of the Vault is met.
az keyvault wait-hsm	Place the CLI in a waiting state until a condition of the HSM is met.

Checks that the managed hsm name is valid and is not already in use.

az keyvault check-name --name
                       [--resource-type {hsm}]

Required Parameters

Optional Parameters

Create a Vault or HSM.

If --enable-rbac-authorization is not specified, then default permissions are created for the current user or service principal unless the --no-self-perms flag is specified.

az keyvault create --resource-group
                   [--administrators]
                   [--bypass {AzureServices, None}]
                   [--default-action {Allow, Deny}]
                   [--enable-purge-protection {false, true}]
                   [--enable-rbac-authorization {false, true}]
                   [--enabled-for-deployment {false, true}]
                   [--enabled-for-disk-encryption {false, true}]
                   [--enabled-for-template-deployment {false, true}]
                   [--hsm-name]
                   [--location]
                   [--name]
                   [--network-acls]
                   [--network-acls-ips]
                   [--network-acls-vnets]
                   [--no-self-perms {false, true}]
                   [--no-wait]
                   [--public-network-access {Disabled, Enabled}]
                   [--retention-days]
                   [--sku]
                   [--tags]

Examples

Create a key vault with network ACLs specified (use --network-acls to specify IP and VNet rules by using a JSON string).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls "{\"ip\": [\"1.2.3.4\", \"2.3.4.0/24\"], \"vnet\": [\"vnet_name_1/subnet_name1\", \"vnet_name_2/subnet_name2\", \"/subscriptions/000000-0000-0000/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/MyVNet/subnets/MySubnet\"]}"

Create a key vault with network ACLs specified (use --network-acls to specify IP and VNet rules by using a JSON file).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls network-acls-example.json

Create a key vault with network ACLs specified (use --network-acls-ips to specify IP rules).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls-ips 3.4.5.0/24 4.5.6.0/24

Create a key vault with network ACLs specified (use --network-acls-vnets to specify VNet rules).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls-vnets vnet_name_2/subnet_name_2 vnet_name_3/subnet_name_3 /subscriptions/000000-0000-0000/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/vnet_name_4/subnets/subnet_name_4

Create a key vault with network ACLs specified (use --network-acls, --network-acls-ips and --network-acls-vnets together, redundant rules will be removed, finally there will be 4 IP rules and 3 VNet rules).

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup --network-acls "{\"ip\": [\"1.2.3.4\", \"2.3.4.0/24\"], \"vnet\": [\"vnet_name_1/subnet_name1\", \"vnet_name_2/subnet_name2\"]}" --network-acls-ips 3.4.5.0/24 4.5.6.0/24 --network-acls-vnets vnet_name_2/subnet_name_2 vnet_name_3/subnet_name_3 /subscriptions/000000-0000-0000/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/vnet_name_4/subnets/subnet_name_4

Create a key vault. (autogenerated)

az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup

Required Parameters

Optional Parameters

Delete a Vault or HSM.

az keyvault delete [--hsm-name]
                   [--name]
                   [--no-wait]
                   [--resource-group]

Examples

Delete a key vault. (autogenerated)

az keyvault delete --name MyKeyVault --resource-group MyResourceGroup

Optional Parameters

Delete security policy settings for a Key Vault.

az keyvault delete-policy --name
                          [--application-id]
                          [--no-wait]
                          [--object-id]
                          [--resource-group]
                          [--spn]
                          [--upn]

Required Parameters

Optional Parameters

List Vaults and/or HSMs.

az keyvault list [--resource-group]
                 [--resource-type]

Optional Parameters

Get information about the deleted Vaults or HSMs in a subscription.

az keyvault list-deleted [--resource-type]

Optional Parameters

Permanently delete the specified Vault or HSM. Aka Purges the deleted Vault or HSM.

az keyvault purge [--hsm-name]
                  [--location]
                  [--name]
                  [--no-wait]

Optional Parameters

Recover a Vault or HSM.

Recover a previously deleted Vault or HSM for which soft delete was enabled.

az keyvault recover [--hsm-name]
                    [--location]
                    [--name]
                    [--no-wait]
                    [--resource-group]

Examples

Recover a key vault. (autogenerated)

az keyvault recover --location westus2 --name MyKeyVault --resource-group MyResourceGroup

Optional Parameters

Update security policy settings for a Key Vault.

az keyvault set-policy --name
                       [--application-id]
                       [--certificate-permissions {all, backup, create, delete, deleteissuers, get, getissuers, import, list, listissuers, managecontacts, manageissuers, purge, recover, restore, setissuers, update}]
                       [--key-permissions {all, backup, create, decrypt, delete, encrypt, get, getrotationpolicy, import, list, purge, recover, release, restore, rotate, setrotationpolicy, sign, unwrapKey, update, verify, wrapKey}]
                       [--no-wait]
                       [--object-id]
                       [--resource-group]
                       [--secret-permissions {all, backup, delete, get, list, purge, recover, restore, set}]
                       [--spn]
                       [--storage-permissions {all, backup, delete, deletesas, get, getsas, list, listsas, purge, recover, regeneratekey, restore, set, setsas, update}]
                       [--upn]

Examples

Assign key permissions `get`, `list`, `import` and secret permissions `backup`, `restore` to an object id.

az keyvault set-policy -n MyVault --key-permissions get list import --secret-permissions backup restore --object-id {GUID}

Assign key permissions `get`, `list` to a UPN (User Principal Name).

az keyvault set-policy -n MyVault --key-permissions get list --upn {UPN}

Assign key permissions `get`, `list` to a SPN (Service Principal Name).

az keyvault set-policy -n MyVault --key-permissions get list --spn {SPN}

Required Parameters

Optional Parameters

Show details of a Vault or HSM.

az keyvault show [--hsm-name]
                 [--name]
                 [--resource-group]

Examples

Show details of a key vault. (autogenerated)

az keyvault show --name MyKeyVault

Optional Parameters

Show details of a deleted Vault or HSM.

az keyvault show-deleted [--hsm-name]
                         [--location]
                         [--name]

Examples

Show details of a deleted key vault.

az keyvault show-deleted --name MyKeyVault

Optional Parameters

Update the properties of a Vault.

az keyvault update --name
                   [--add]
                   [--bypass {AzureServices, None}]
                   [--default-action {Allow, Deny}]
                   [--enable-purge-protection {false, true}]
                   [--enable-rbac-authorization {false, true}]
                   [--enabled-for-deployment {false, true}]
                   [--enabled-for-disk-encryption {false, true}]
                   [--enabled-for-template-deployment {false, true}]
                   [--force-string]
                   [--no-wait]
                   [--public-network-access {Disabled, Enabled}]
                   [--remove]
                   [--resource-group]
                   [--retention-days]
                   [--set]

Examples

Update the properties of a Vault. (autogenerated)

az keyvault update --enabled-for-disk-encryption true --name MyKeyVault --resource-group MyResourceGroup

Required Parameters

Optional Parameters

Update the properties of a HSM.

az keyvault update-hsm --hsm-name
                       [--add]
                       [--bypass {AzureServices, None}]
                       [--default-action {Allow, Deny}]
                       [--enable-purge-protection {false, true}]
                       [--force-string]
                       [--no-wait]
                       [--public-network-access {Disabled, Enabled}]
                       [--remove]
                       [--resource-group]
                       [--secondary-locations]
                       [--set]

Examples

Update the properties of a HSM.

az keyvault update-hsm --enable-purge-protection true --hsm-name MyHSM --resource-group MyResourceGroup

Required Parameters

Optional Parameters

Place the CLI in a waiting state until a condition of the Vault is met.

az keyvault wait --name
                 [--created]
                 [--custom]
                 [--deleted]
                 [--exists]
                 [--interval]
                 [--resource-group]
                 [--timeout]
                 [--updated]

Examples

Pause CLI until the vault is created.

az keyvault wait --name MyVault --created

Required Parameters

Optional Parameters

Place the CLI in a waiting state until a condition of the HSM is met.

az keyvault wait-hsm --hsm-name
                     [--created]
                     [--custom]
                     [--deleted]
                     [--exists]
                     [--interval]
                     [--resource-group]
                     [--timeout]
                     [--updated]

Examples

Pause CLI until the HSM is created.

az keyvault wait-hsm --hsm-name MyHSM --created

Required Parameters

Optional Parameters