[DO NOT MERGE][Keyvault] Filter out certificates from `Get-AzKeyVaultSecret` and `Get-AzKeyVaultKey` #29015

DanielMicrosoft · 2025-12-30T03:13:12Z

Description

This PR filters out secrets or keys by the Managed property, to prevent certificates showing on the Get cmdlets for Keys and Secrets.

This matches the filtering that azure-cli does.

Note on included tests: There was some trouble creating scenario tests for this functionality, this is apparently a known limitation of scenario tests in the certificates domain. I have included pester tests to describe/manually test desired functionality.

Note: Need to discuss if we would classify this as a breaking change, it doesn't seem to fit cleanly into any breaking change definition in the guide. But it will do additional filtering to results that wasn't there before, and may confuse users who started relying on incumbent behaviour of affected cmdlets.

Mandatory Checklist

Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)
- General release
- Public preview
- Private preview
- Engineering build
- No need for a release
Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

SHOULD update ChangeLog.md file(s) appropriately
- Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
  - A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
- Should not change ChangeLog.md if no new release is required, such as fixing test case only.
SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
SHOULD have proper test coverage for changes in pull request.
SHOULD NOT adjust version of module manually in pull request

azure-client-tools-bot-prd · 2025-12-30T03:13:19Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

github-actions · 2025-12-30T03:13:39Z

‼️ DO NOT MERGE THIS PR ‼️
This PR was labeled "Do Not Merge" because it contains code change that cannot be merged. Please contact the reviewer for more information.

Copilot

Pull request overview

This PR adds filtering to the Get-AzKeyVaultKey and Get-AzKeyVaultSecret cmdlets to exclude certificate-managed keys and secrets from their results. This aligns PowerShell behavior with Azure CLI, which already filters out these items. When a certificate is imported into Azure Key Vault, it automatically creates both a key and a secret with the same name and marks them as managed by the certificate. This change ensures that these automatically-created items don't appear in key and secret listings.

Key changes:

Added filtering logic based on the Managed property in both Track2 and legacy client implementations
Filters are applied to both list operations (GetKeys/GetSecrets) and version listing operations (GetKeyVersions/GetSecretVersions)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
src/KeyVault/KeyVault/Track2Models/Track2VaultClient.cs	Added filtering to exclude certificate-managed keys in GetKeys and GetKeyVersions methods using continue statements when Managed property is true
src/KeyVault/KeyVault/Models/Client/KeyVaultDataServiceClient.cs	Added LINQ Where clause to filter certificate-managed secrets in GetSecrets and GetSecretVersions methods

src/KeyVault/KeyVault/Track2Models/Track2VaultClient.cs

DanielMicrosoft · 2025-12-30T03:24:55Z

/azp run

azure-pipelines · 2025-12-30T03:25:10Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

This reverts commit 74a1c36.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/KeyVault/KeyVault/Track2Models/Track2VaultClient.cs:152

The filtering logic for Managed HSM keys is missing. The Track2HsmClient.GetKeys() and Track2HsmClient.GetKeyAllVersions() methods in Track2HsmClient.cs should also filter out managed (certificate-backed) keys, similar to how regular vault keys are filtered here. Certificate-backed keys exist in Managed HSMs as well, and for consistency with Azure CLI and the regular vault behavior, they should be excluded from these list operations.

        private IEnumerable<PSKeyVaultKeyIdentityItem> GetKeys(KeyClient client)
        {
            var results = new List<PSKeyVaultKeyIdentityItem>();
            var allKeys = client.GetPropertiesOfKeys();
            foreach (var keyProperties in allKeys)
            {
                if (keyProperties.Managed == true)
                {
                    continue;
                }
                results.Add(new PSKeyVaultKeyIdentityItem(keyProperties, _vaultUriHelper, false));
            }
            return results;
        }

src/KeyVault/KeyVault/Models/Client/KeyVaultDataServiceClient.cs

Copilot · 2025-12-31T00:23:29Z

src/KeyVault/KeyVault/Models/Client/KeyVaultDataServiceClient.cs

+                    result.Where((secretItem) => secretItem.Managed != true)
+                          .Select((secretItem) => new PSKeyVaultSecretIdentityItem(secretItem, this.vaultUriHelper));


Consider filtering deleted secrets as well. The GetDeletedSecrets() method should also filter out certificate-backed secrets (where Managed == true) for consistency. When a certificate is deleted, its corresponding secret is also deleted, and it should remain hidden from the deleted secrets list. Apply the same filtering pattern used here for GetSecrets() and GetSecretVersions().

Note: need to discuss if we should actually implement this on deleted secrets, azure-cli does not filter on this property for deleted keys/secrets.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

Copilot · 2025-12-31T04:34:32Z

src/KeyVault/KeyVault.Test/PesterTests/CertificateBackedKeyFiltering.Tests.ps1

+$vaultName = 'danielKV7103'
+. "$PSScriptRoot\..\Scripts\Common.ps1"


The hardcoded vault name 'danielKV7103' should not be committed to the repository. This appears to be a personal test vault. Following the pattern in other test files like Certificate.Tests.ps1 and Key.Tests.ps1, you should either use a placeholder comment or use a vault name that's clearly for testing purposes. Consider using a BeforeAll block to set this value as well, consistent with Certificate.Tests.ps1.

Suggested change

$vaultName = 'danielKV7103'

. "$PSScriptRoot\..\Scripts\Common.ps1"

. "$PSScriptRoot\..\Scripts\Common.ps1"

$vaultName = Get-KeyVaultName

Copilot · 2025-12-31T04:34:33Z

src/KeyVault/KeyVault.Test/PesterTests/CertificateBackedKeyFiltering.Tests.ps1

+$debugModulePath = "$PSScriptRoot\..\..\..\..\artifacts\Debug\Az.KeyVault\Az.KeyVault.psd1"
+Import-Module $debugModulePath -Force
+


The hardcoded debug module path should not be included in committed tests. Other test files in the PesterTests directory do not import modules explicitly at the file level. This import should either be removed or handled through the test infrastructure. Additionally, the path uses a relative reference that assumes a specific build artifact location which may not be portable across different test environments.

Suggested change

$debugModulePath = "$PSScriptRoot\..\..\..\..\artifacts\Debug\Az.KeyVault\Az.KeyVault.psd1"

Import-Module $debugModulePath -Force

Copilot · 2025-12-31T04:34:33Z

src/KeyVault/KeyVault.Test/PesterTests/CertificateBackedKeyFiltering.Tests.ps1

+
+        Start-Sleep -Seconds 30
+        $cert = Get-AzKeyVaultCertificate -VaultName $vaultName -Name $certName
+        $cert | Should Not BeNullOrEmpty


The test uses outdated Pester syntax without the dash separator. Following the established convention in this codebase (see ManagedHsmDataPlaneTests.Tests.ps1 and MhsmKey.Tests.ps1), this should use modern Pester syntax with 'Should -Not -BeNullOrEmpty'. The same issue applies to lines 22, 27, 30, 47, 52, and 55.

Copilot · 2025-12-31T04:34:33Z

src/KeyVault/KeyVault.Test/PesterTests/CertificateBackedKeyFiltering.Tests.ps1

+        $policy = New-AzKeyVaultCertificatePolicy -SecretContentType "application/x-pkcs12" -SubjectName "CN=test.contoso.com" -IssuerName Self -ValidityInMonths 6
+        $certOp = Add-AzKeyVaultCertificate -VaultName $vaultName -Name $certName -CertificatePolicy $policy
+
+        Start-Sleep -Seconds 30


The 30-second sleep duration may not be sufficient for certificate creation to complete in all environments. Azure Key Vault certificate creation is asynchronous and can take longer depending on load. Consider either increasing the sleep duration to 60 seconds, or implementing a polling mechanism that waits for the certificate operation to complete (checking $certOp.Status until it's "completed"). The same issue exists on line 43.

feature: add filters to exclude certs from keys/screts get cmdlets

1dd9559

Copilot AI review requested due to automatic review settings December 30, 2025 03:13

DanielMicrosoft added the Do Not Merge 🚫 label Dec 30, 2025

Copilot started reviewing on behalf of DanielMicrosoft December 30, 2025 03:15 View session

DanielMicrosoft changed the title ~~feature: add filters to exclude certs from keys/screts get cmdlets~~ [DO NOT MERGE][Keyvault] Filter out certificates from Get-AzKeyVaultSecret and Get-AzKeyVaultKey Dec 30, 2025

Copilot AI reviewed Dec 30, 2025

View reviewed changes

src/KeyVault/KeyVault/Track2Models/Track2VaultClient.cs Outdated Show resolved Hide resolved

src/KeyVault/KeyVault/Track2Models/Track2VaultClient.cs Outdated Show resolved Hide resolved

Copilot AI reviewed Dec 30, 2025

View reviewed changes

DanielMicrosoft added 2 commits December 30, 2025 16:18

test: add test in RunKeyVaultTests

74a1c36

Revert "test: add test in RunKeyVaultTests"

3bf2688

This reverts commit 74a1c36.

Copilot AI review requested due to automatic review settings December 31, 2025 00:13

Copilot started reviewing on behalf of DanielMicrosoft December 31, 2025 00:15 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

DanielMicrosoft added 2 commits December 31, 2025 14:47

test: add pester tests for certificate filtering

357f6dc

fix: address copilot suggestions

8e4f354

Copilot AI review requested due to automatic review settings December 31, 2025 04:24

Copilot started reviewing on behalf of DanielMicrosoft December 31, 2025 04:26 View session

Copilot AI reviewed Dec 31, 2025

View reviewed changes

		result.Where((secretItem) => secretItem.Managed != true)
		.Select((secretItem) => new PSKeyVaultSecretIdentityItem(secretItem, this.vaultUriHelper));

		$vaultName = 'danielKV7103'
		. "$PSScriptRoot\..\Scripts\Common.ps1"

		$debugModulePath = "$PSScriptRoot\..\..\..\..\artifacts\Debug\Az.KeyVault\Az.KeyVault.psd1"
		Import-Module $debugModulePath -Force

[DO NOT MERGE][Keyvault] Filter out certificates from Get-AzKeyVaultSecret and Get-AzKeyVaultKey #29015

Are you sure you want to change the base?

[DO NOT MERGE][Keyvault] Filter out certificates from Get-AzKeyVaultSecret and Get-AzKeyVaultKey #29015

Uh oh!

Conversation

DanielMicrosoft commented Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Mandatory Checklist

Uh oh!

azure-client-tools-bot-prd bot commented Dec 30, 2025

Uh oh!

github-actions bot commented Dec 30, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

DanielMicrosoft commented Dec 30, 2025

Uh oh!

azure-pipelines bot commented Dec 30, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

DanielMicrosoft Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

[DO NOT MERGE][Keyvault] Filter out certificates from `Get-AzKeyVaultSecret` and `Get-AzKeyVaultKey` #29015

[DO NOT MERGE][Keyvault] Filter out certificates from `Get-AzKeyVaultSecret` and `Get-AzKeyVaultKey` #29015

DanielMicrosoft commented Dec 30, 2025 •

edited

Loading