Az.KeyVault module: setup and commands
Documentation: Microsoft Learn
Find vaults with Get-AzKeyVault, retrieve secrets deliberately and distinguish control-plane access from permission to read secret values.
Getting it
Install-PSResource -Name Az.KeyVault from the PowerShell Gallery.
Examples
1PS> Get-AzKeyVault
Show reference output
1 VaultName ResourceGroupName Location
2 --------- ----------------- --------
3 kv-prod-01 RG-PROD eastus
1PS> Get-AzKeyVaultCertificate -VaultName ContosoVault -Name WebCert
Show reference output
1 VaultName Name Version Expires Enabled
2 --------- ---- ------- ------- -------
3 ContosoVault WebCert a1b2c3d4 12/31/2026 11:59:59 PM True
What it is for
Use it to pull secrets into automation without committing them to source control. Certificate expiry reporting also lives here, which makes it a natural feed into a renewal pipeline.
Typical tasks
- List vaults across a subscription
- Retrieve a secret for a deployment step
- Report certificates expiring inside a window
- Audit access policies and role assignments
- Check soft delete and purge protection settings
- Record the new version after a rotation
Check the installed version
1PS> Get-Module -ListAvailable Az.KeyVault | Select-Object Name, Version, Path
2PS> Get-Command -Module Az.KeyVault
Compare the module path and version with the session used by your scheduled task or automation account. Use it to pull secrets into automation without committing them to source control. Certificate expiry reporting also lives here, which makes it a natural feed into a renewal pipeline.
