[Key Vault] `az keyvault create`: Support new Managed HSM SKUs `Standard_B1v2`, `Standard_B5v2`, `Standard_B10v2`, `Standard_B15v2`, `Standard_B20v2` by neerjagangwar · Pull Request #34234 · Azure/azure-cli

neerjagangwar · 2026-10-16T14:26:43Z

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Related command

az keyvault create --hsm-name ... --sku ...
All az keyvault control-plane commands

Description

Bump azure-mgmt-keyvault from 14.0.1 to 14.1.0. This moves the Key Vault control plane to API version 2026-05-15.

Customer impact

az keyvault create --hsm-name accepts the new Managed HSM SKUs Standard_B1v2, Standard_B5v2, Standard_B10v2, Standard_B15v2 and Standard_B20v2. The service rejects these on the older API version.
The --sku help text lists the new SKUs. The default is still Standard_B1.
No breaking changes.

Files changed

File	Change
`setup.py`, `requirements.py3.{Darwin,Linux,windows}.txt`	Pin `azure-mgmt-keyvault==14.1.0`
`keyvault/_params.py`	Update `--sku` help text
`servicefabric/custom.py`	Pass `family='A'` when creating a Key Vault
`keyvault/_validators.py`, `servicefabric/custom.py`, `servicefabric/_client_factory.py`	Use api-version `2015-11-01` for the `vaults.list()` lookups (see below)
`azure-cli-testsdk/.../utilities.py`, `base.py`	New `MSGraphUserProfileReplacer` recording processor (see below)

ServiceFabric fix: family is required by the SDK in both 14.0.1 and 14.1.0. Without it, creating a Key Vault fails client-side before any request is sent. The Key Vault module already passes it.

Test SDK: sanitize Microsoft Graph user profiles. Tests that call az ad signed-in-user show or resolve assignees record the signed-in user's Graph profile. EmailAddressReplacer only masks the email, so names, phone numbers, job title and office location were being committed in recordings. The new processor runs by default for every ScenarioTest:

it clears contact fields (phones, job title, office location, address) on any Graph user object;
it replaces the signed-in user's display name, given name and surname, learned from /me, with Test User / Test / User in all later responses.

Workaround for an azure-mgmt-keyvault 14.1.0 regression. vaults.list() calls ARM /resources. Page 1 uses 2015-11-01, but in 14.1.0 the next-link pages use the client's api-version (2026-05-15), which ARM rejects with InvalidApiVersionParameter. 14.0.1 had fixed this (Azure/azure-sdk-for-python#45955), but the 14.1.0 regeneration dropped the fix. The CLI creates the client for these lookups with api_version='2015-11-01'. This affects az keyvault ... --name without -g, the default CVM release-policy lookup, and az sf cluster create --secret-identifier. The workaround will be removed once a fixed SDK ships.

References: Azure SDK Release Plan 36121. Spec PR: Azure/azure-rest-api-specs#46950.

Testing Guide

az keyvault create --hsm-name myhsm -g myrg -l <region> --sku Standard_B1v2 --administrators <oid> --retention-days 7
az keyvault show --hsm-name myhsm --query sku

Recordings: 37 cassettes were re-recorded live against 2026-05-15, not hand-edited. All of them pass in playback, and none of them references 2026-02-01. Every cassette went through the new profile sanitizer and azdev scan.

Module	Count
keyvault	20
vm	8
network	4
appconfig, netappfiles, search, servicefabric, storage	1 each

Not re-recorded. These keep their existing recordings. Only the api-version of their Microsoft.KeyVault request URIs was changed to 2026-05-15; response bodies are unchanged. Requests made through az resource update keep the version they resolved from the recorded provider metadata. Live re-recording was blocked for these reasons:

Test(s)	Reason
eventhubs / servicebus namespace encryption	Subscription policy blocks local auth
sql_per_db_cmk, sql_tdebyok, disk_encryption_set_identity	Require `eastus2euap`
confidential_disk_encryption_set, disk_encryption_set_disk_update, vm_create_windows_secrets, vmss_create_linux_secrets	Test image retired (Windows 2012-R2 / Debian 10)
ams_encryption_set_show, storage customer_managed_key, servicefabric ×4	Test creates a Storage v1 account (`AccountKindNotSupported`)
batch_byos_account_cmd	Batch BYOS access required
aks_approuting ×2	VM size not allowed in subscription
vm_disk_encryption_with_identity ×3	Feature `ADEWithManagedIdentity` needs allow-listing
backup_encryption	Test assumes an access-policy vault; the CLI now defaults to RBAC
mysql_flexible_server_byok_mgmt	Repeated InternalServerError from the service
network_app_gateway_ssl_cert_managed_hsm	Repeated `UpdateGatewayInProgress`
keyvault_hsm_key_release_policy	Intermittent Managed HSM activation timing
network_express_route_port	Creates a real ExpressRoute Direct port; not run

History Notes

[Key Vault] az keyvault create: Support new Managed HSM SKUs Standard_B1v2, Standard_B5v2, Standard_B10v2, Standard_B15v2, Standard_B20v2
[ServiceFabric] az sf cluster create, az sf application certificate add: Fix creating a new Key Vault failing due to missing SKU family

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

…ged HSM SKUs Upgrades `azure-mgmt-keyvault` 14.0.1 -> 14.1.0 so all `az keyvault` control-plane operations target ARM API version `2026-05-15`. API version `2026-05-15` adds five new Managed HSM SKUs: `Standard_B1v2`, `Standard_B5v2`, `Standard_B10v2`, `Standard_B15v2` and `Standard_B20v2`. These cannot be used today because the CLI is pinned to `2026-02-01`, where the resource provider rejects them. Changes: - `setup.py` + `requirements.py3.{Darwin,Linux,windows}.txt`: `azure-mgmt-keyvault==14.1.0` (its default api-version is `2026-05-15`). `MGMT_KEYVAULT` is unpinned in `AZURE_API_PROFILES`, so the client rides the SDK default and no profile change is needed. - `keyvault/_params.py`: add the five new SKUs to the `az keyvault create` `--sku` help text, which still listed only the pre-existing five. No code change is needed in `create_hsm`: `sku_family` is derived as `sku.split('_')[1][0]`, which yields `B` for all five new SKU names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

…ects in recordings Clear contact fields (phones, job title, office location, address) on Graph user objects and replace the signed-in user's names learned from /me with mock values. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Copilot

🟡 Changes recommended

Unresolved playback incompatibilities and sanitizer correctness gaps can break tests and retain personal names.

3 open findings

What changed in this PR

Updates Key Vault management support for the new Managed HSM SKUs and improves test-recording sanitization.

Changes:

Bumps azure-mgmt-keyvault to 14.1.0 and expands SKU help.
Supplies the required SKU family when Service Fabric creates a vault.
Refreshes recordings and adds default Graph profile sanitization.

File	Description
`src/azure-cli/setup.py`	Updates the Key Vault SDK dependency.
`src/azure-cli/requirements.py3.windows.txt`	Updates the Windows dependency pin.
`src/azure-cli/requirements.py3.Linux.txt`	Updates the Linux dependency pin.
`src/azure-cli/requirements.py3.Darwin.txt`	Updates the macOS dependency pin.
`src/azure-cli/azure/cli/command_modules/servicefabric/custom.py`	Adds the required vault SKU family.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_mhsm_private_link_resource.yaml`	Refreshes HSM private-link recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_secret_soft_delete.yaml`	Refreshes secret soft-delete recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_public_network_access.yaml`	Refreshes network-access recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_private_link_resource.yaml`	Refreshes vault private-link recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_key_rotation.yaml`	Refreshes key-rotation recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_hsm_key_random.yaml`	Refreshes HSM random-data recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_certificate_soft_delete.yaml`	Refreshes certificate soft-delete recording.
`src/azure-cli/azure/cli/command_modules/keyvault/_params.py`	Lists the new HSM SKUs in help.
`src/azure-cli-testsdk/azure/cli/testsdk/utilities.py`	Adds Graph user-profile sanitization.
`src/azure-cli-testsdk/azure/cli/testsdk/base.py`	Registers the sanitizer by default.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…project.toml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Yong Zhang (yonzhan) · 2026-10-16T20:27:25Z

/azp run

azure-pipelines · 2026-10-16T20:27:32Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

Only replace decoded JSON string values that exactly match a learned name, so short names cannot corrupt keys/URLs; recognize all built-in cloud Graph hosts; add unit tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Api-version-only updates for Microsoft.KeyVault requests in tests that were not re-recorded, following the approach of Azure#33895. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Aditya Pujara (a0x1ab) · 2026-10-19T11:56:01Z

/azp run

azure-pipelines · 2026-10-19T11:56:20Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-mgmt-keyvault 14.1.0 regressed the 14.0.1 fix (azure-sdk-for-python#45955): vaults.list() next-link pages use the client api-version, which ARM /resources rejects. Create the client used for these lookups with api_version=2015-11-01 until a fixed SDK ships. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87

…customer_managed_key recording These requests come from az resource update, which resolves 2026-02-01 from the recorded provider metadata. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87

Aditya Pujara (a0x1ab) · 2026-10-20T18:20:28Z

/azp run

azure-pipelines · 2026-10-20T18:20:52Z

Azure Pipelines: Successfully started running 3 pipeline(s).

neerjagangwar · 2026-10-20T19:13:01Z

/azp run

azure-pipelines · 2026-10-20T19:13:09Z

Commenter does not have sufficient privileges for PR 34234 in repo Azure/azure-cli

Alex Wang (Alex-AZPS) · 2026-10-20T21:21:23Z

@Azure/act-identity-squad can you help review this keyVault PR ?

neerja581 and others added 4 commits October 11, 2026 15:56

[ServiceFabric] Pass required sku family when creating Key Vault

39c4672

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

[Key Vault] Re-record tests live against api-version 2026-05-15

9fb2862

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Copilot AI balanced review requested due to automatic review settings October 16, 2026 14:26

neerjagangwar requested review from a team as code owners October 16, 2026 14:26

microsoft-github-policy-service Bot requested review from Yu Chen (jsntcy), ZelinWang (wangzelin007) and Yong Zhang (yonzhan) October 16, 2026 14:27

Copilot started reviewing on behalf of neerjagangwar October 16, 2026 14:27

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Comment thread src/azure-cli-testsdk/azure/cli/testsdk/utilities.py Outdated

Comment thread src/azure-cli/setup.py Outdated

Comment thread src/azure-cli-testsdk/azure/cli/testsdk/utilities.py Outdated

x-engineering-agent Bot added this to the November 2026 (2026-11-03) milestone Oct 16, 2026

[Key Vault] Merge upstream dev and move azure-mgmt-keyvault pin to py…

f03e6b0

…project.toml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

neerja581 and others added 2 commits October 19, 2026 12:47

neerjagangwar requested a review from FumingZhang as a code owner October 19, 2026 11:55

neerja581 and others added 2 commits October 20, 2026 19:18

Navigation Menu

Repository navigation

[Key Vault] `az keyvault create`: Support new Managed HSM SKUs `Standard_B1v2`, `Standard_B5v2`, `Standard_B10v2`, `Standard_B15v2`, `Standard_B20v2` - #34234

[Key Vault] `az keyvault create`: Support new Managed HSM SKUs `Standard_B1v2`, `Standard_B5v2`, `Standard_B10v2`, `Standard_B15v2`, `Standard_B20v2`#34234
neerjagangwar wants to merge 9 commits into
Azure:devfrom
neerjagangwar:keyvault/mgmt-keyvault-2026-05-15

neerjagangwar commented Oct 16, 2026 •

edited by x-engineering-agent Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Yong Zhang (yonzhan) commented Oct 16, 2026

Uh oh!

azure-pipelines Bot commented Oct 16, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 19, 2026

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 20, 2026

Uh oh!

azure-pipelines Bot commented Oct 20, 2026

Uh oh!

neerjagangwar commented Oct 20, 2026

Uh oh!

azure-pipelines Bot commented Oct 20, 2026

Uh oh!

Alex Wang (Alex-AZPS) commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

neerjagangwar commented Oct 16, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ️✔️ All clear

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Yong Zhang (yonzhan) commented Oct 16, 2026

Uh oh!

azure-pipelines Bot commented Oct 16, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 19, 2026

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 20, 2026

Uh oh!

azure-pipelines Bot commented Oct 20, 2026

Uh oh!

neerjagangwar commented Oct 20, 2026

Uh oh!

azure-pipelines Bot commented Oct 20, 2026

Uh oh!

Alex Wang (Alex-AZPS) commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

neerjagangwar commented Oct 16, 2026 •

edited by x-engineering-agent Bot

Loading