[Key Vault] `az keyvault create`: Support new Managed HSM SKUs `Standard_B1v2`, `Standard_B5v2`, `Standard_B10v2`, `Standard_B15v2`, `Standard_B20v2` by neerjagangwar · Pull Request #34234 · Azure/azure-cli

neerjagangwar · 2026-10-16T14:26:43Z

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Related command

az keyvault create --hsm-name ... --sku ...
All az keyvault control-plane commands

Description

Bump azure-mgmt-keyvault from 14.0.1 to 14.1.0. This moves the Key Vault control plane to API version 2026-05-15.

Customer impact

az keyvault create --hsm-name accepts the new Managed HSM SKUs Standard_B1v2, Standard_B5v2, Standard_B10v2, Standard_B15v2 and Standard_B20v2. The service rejects these on the older API version.
The --sku help text lists the new SKUs. The default is still Standard_B1.
No breaking changes.

Files changed

File	Change
`setup.py`, `requirements.py3.{Darwin,Linux,windows}.txt`	Pin `azure-mgmt-keyvault==14.1.0`
`keyvault/_params.py`	Update `--sku` help text
`servicefabric/custom.py`	Pass `family='A'` when creating a Key Vault
`keyvault/_validators.py`, `servicefabric/custom.py`, `servicefabric/_client_factory.py`	Use api-version `2015-11-01` for the `vaults.list()` lookups (see below)
`azure-cli-testsdk/.../utilities.py`, `base.py`	New `MSGraphUserProfileReplacer` recording processor (see below)

ServiceFabric fix: family is required by the SDK in both 14.0.1 and 14.1.0. Without it, creating a Key Vault fails client-side before any request is sent. The Key Vault module already passes it.

Test SDK: sanitize Microsoft Graph user profiles. Tests that call az ad signed-in-user show or resolve assignees record the signed-in user's Graph profile. EmailAddressReplacer only masks the email, so names, phone numbers, job title and office location were being committed in recordings. The new processor runs by default for every ScenarioTest:

it clears contact fields (phones, job title, office location, address) on any Graph user object;
it replaces the signed-in user's display name, given name and surname, learned from /me, with Test User / Test / User in all later responses.

Workaround for an azure-mgmt-keyvault 14.1.0 regression. vaults.list() calls ARM /resources. Page 1 uses 2015-11-01, but in 14.1.0 the next-link pages use the client's api-version (2026-05-15), which ARM rejects with InvalidApiVersionParameter. 14.0.1 had fixed this (Azure/azure-sdk-for-python#45955), but the 14.1.0 regeneration dropped the fix. The CLI creates the client for these lookups with api_version='2015-11-01'. This affects az keyvault ... --name without -g, the default CVM release-policy lookup, and az sf cluster create --secret-identifier. The workaround will be removed once a fixed SDK ships.

References: Azure SDK Release Plan 36121. Spec PR: Azure/azure-rest-api-specs#46950.

Testing Guide

az keyvault create --hsm-name myhsm -g myrg -l <region> --sku Standard_B1v2 --administrators <oid> --retention-days 7
az keyvault show --hsm-name myhsm --query sku

Recordings: 37 cassettes were re-recorded live against 2026-05-15, not hand-edited. All of them pass in playback, and none of them references 2026-02-01. Every cassette went through the new profile sanitizer and azdev scan.

Module	Count
keyvault	20
vm	8
network	4
appconfig, netappfiles, search, servicefabric, storage	1 each

Not re-recorded. These keep their existing recordings. Only the api-version of their Microsoft.KeyVault request URIs was changed to 2026-05-15; response bodies are unchanged. Requests made through az resource update keep the version they resolved from the recorded provider metadata. Live re-recording was blocked for these reasons:

Test(s)	Reason
eventhubs / servicebus namespace encryption	Subscription policy blocks local auth
sql_per_db_cmk, sql_tdebyok, disk_encryption_set_identity	Require `eastus2euap`
confidential_disk_encryption_set, disk_encryption_set_disk_update, vm_create_windows_secrets, vmss_create_linux_secrets	Test image retired (Windows 2012-R2 / Debian 10)
ams_encryption_set_show, storage customer_managed_key, servicefabric ×4	Test creates a Storage v1 account (`AccountKindNotSupported`)
batch_byos_account_cmd	Batch BYOS access required
aks_approuting ×2	VM size not allowed in subscription
vm_disk_encryption_with_identity ×3	Feature `ADEWithManagedIdentity` needs allow-listing
backup_encryption	Test assumes an access-policy vault; the CLI now defaults to RBAC
mysql_flexible_server_byok_mgmt	Repeated InternalServerError from the service
network_app_gateway_ssl_cert_managed_hsm	Repeated `UpdateGatewayInProgress`
keyvault_hsm_key_release_policy	Intermittent Managed HSM activation timing
network_express_route_port	Creates a real ExpressRoute Direct port; not run

History Notes

[Key Vault] az keyvault create: Support new Managed HSM SKUs Standard_B1v2, Standard_B5v2, Standard_B10v2, Standard_B15v2, Standard_B20v2
[ServiceFabric] az sf cluster create, az sf application certificate add: Fix creating a new Key Vault failing due to missing SKU family

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

…ged HSM SKUs Upgrades `azure-mgmt-keyvault` 14.0.1 -> 14.1.0 so all `az keyvault` control-plane operations target ARM API version `2026-05-15`. API version `2026-05-15` adds five new Managed HSM SKUs: `Standard_B1v2`, `Standard_B5v2`, `Standard_B10v2`, `Standard_B15v2` and `Standard_B20v2`. These cannot be used today because the CLI is pinned to `2026-02-01`, where the resource provider rejects them. Changes: - `setup.py` + `requirements.py3.{Darwin,Linux,windows}.txt`: `azure-mgmt-keyvault==14.1.0` (its default api-version is `2026-05-15`). `MGMT_KEYVAULT` is unpinned in `AZURE_API_PROFILES`, so the client rides the SDK default and no profile change is needed. - `keyvault/_params.py`: add the five new SKUs to the `az keyvault create` `--sku` help text, which still listed only the pre-existing five. No code change is needed in `create_hsm`: `sku_family` is derived as `sku.split('_')[1][0]`, which yields `B` for all five new SKU names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

…ects in recordings Clear contact fields (phones, job title, office location, address) on Graph user objects and replace the signed-in user's names learned from /me with mock values. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Copilot

🟡 Changes recommended

Unresolved playback incompatibilities and sanitizer correctness gaps can break tests and retain personal names.

3 open findings

What changed in this PR

Updates Key Vault management support for the new Managed HSM SKUs and improves test-recording sanitization.

Changes:

Bumps azure-mgmt-keyvault to 14.1.0 and expands SKU help.
Supplies the required SKU family when Service Fabric creates a vault.
Refreshes recordings and adds default Graph profile sanitization.

File	Description
`src/azure-cli/setup.py`	Updates the Key Vault SDK dependency.
`src/azure-cli/requirements.py3.windows.txt`	Updates the Windows dependency pin.
`src/azure-cli/requirements.py3.Linux.txt`	Updates the Linux dependency pin.
`src/azure-cli/requirements.py3.Darwin.txt`	Updates the macOS dependency pin.
`src/azure-cli/azure/cli/command_modules/servicefabric/custom.py`	Adds the required vault SKU family.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_mhsm_private_link_resource.yaml`	Refreshes HSM private-link recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_secret_soft_delete.yaml`	Refreshes secret soft-delete recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_public_network_access.yaml`	Refreshes network-access recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_private_link_resource.yaml`	Refreshes vault private-link recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_key_rotation.yaml`	Refreshes key-rotation recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_hsm_key_random.yaml`	Refreshes HSM random-data recording.
`src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_certificate_soft_delete.yaml`	Refreshes certificate soft-delete recording.
`src/azure-cli/azure/cli/command_modules/keyvault/_params.py`	Lists the new HSM SKUs in help.
`src/azure-cli-testsdk/azure/cli/testsdk/utilities.py`	Adds Graph user-profile sanitization.
`src/azure-cli-testsdk/azure/cli/testsdk/base.py`	Registers the sanitizer by default.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…project.toml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Yong Zhang (yonzhan) · 2026-10-16T20:27:25Z

/azp run

azure-pipelines · 2026-10-16T20:27:32Z

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

Only replace decoded JSON string values that exactly match a learned name, so short names cannot corrupt keys/URLs; recognize all built-in cloud Graph hosts; add unit tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Api-version-only updates for Microsoft.KeyVault requests in tests that were not re-recorded, following the approach of Azure#33895. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Aditya Pujara (a0x1ab) · 2026-10-19T11:56:01Z

/azp run

azure-pipelines · 2026-10-19T11:56:20Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-mgmt-keyvault 14.1.0 regressed the 14.0.1 fix (azure-sdk-for-python#45955): vaults.list() next-link pages use the client api-version, which ARM /resources rejects. Create the client used for these lookups with api_version=2015-11-01 until a fixed SDK ships. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87

…customer_managed_key recording These requests come from az resource update, which resolves 2026-02-01 from the recorded provider metadata. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87

Aditya Pujara (a0x1ab) · 2026-10-20T18:20:28Z

/azp run

azure-pipelines · 2026-10-20T18:20:52Z

Azure Pipelines: Successfully started running 3 pipeline(s).

neerjagangwar · 2026-10-20T19:13:01Z

/azp run

azure-pipelines · 2026-10-20T19:13:09Z

Commenter does not have sufficient privileges for PR 34234 in repo Azure/azure-cli

Alex Wang (Alex-AZPS) · 2026-10-20T21:21:23Z

@Azure/act-identity-squad can you help review this keyVault PR ?

Remove other teams' Managed HSMs/vaults from list responses and mask the recording subscription ID and policy-assigned identity RG names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87

Aditya Pujara (a0x1ab) · 2026-10-21T17:11:38Z

/azp run

azure-pipelines · 2026-10-21T17:11:57Z

Azure Pipelines: Successfully started running 3 pipeline(s).

x-engineering-agent · 2026-10-23T01:06:04Z

X Engineering Agent Report

Review — Comments

neerjagangwar

Upstream CI: 52 passed, 0 failed, 0 pending. No confirmed semantic findings remain. All three Copilot comments are addressed at this head: decoded JSON redaction, the cited recording API versions, and sovereign Graph endpoint recognition.

Test validation

Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
Regression coverage: For keyvault, servicefabric: 0 focused test file(s) and 26 recording file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

Scenario verification

CI passed, but issue-scenario regression coverage is not verified. Author-provided recordings are not Agent live-test evidence; matching updated request URIs does not establish service-response/output compatibility with API 2026-05-15. Add focused scenario coverage before merge.

Paths below are relative to src/azure-cli/azure/cli/command_modules/:

keyvault/tests/latest/test_keyvault_commands.py:633-709 exercises default Standard_B1; keyvault/tests/latest/recordings/test_keyvault_hsm_mgmt.yaml:55-78 likewise records that SKU, not the five new v2 SKUs. Verify each new SKU's outgoing name/family and returned SKU.
The name-only lookup in keyvault/tests/latest/test_keyvault_commands.py:758-764 and keyvault/tests/latest/recordings/test_keyvault_mgmt.yaml:334-337 do not demonstrate a second ARM /resources page. The observed later pagination belongs to resource-group vault listing, a different path.
servicefabric/tests/latest/test_sf_cluster.py:20-43 exercises cluster creation. servicefabric/tests/latest/recordings/test_create_cluster_with_separate_kv.yaml:424-428 shows the pinned /resources request without continuation; servicefabric/tests/latest/recordings/test_create_cluster_with_location_different_from_resource_group.yaml:148-175 records family A and the new API. These happy paths do not establish the repaired continuation behavior.

Focused verification: rerun azdev test test_keyvault_hsm_mgmt test_keyvault_mgmt test_create_cluster_with_separate_kv test_create_cluster_with_location_different_from_resource_group; extend focused cases to assert v2 SKU request/output mappings and a multi-page /resources lookup retaining 2015-11-01. Refresh affected author recordings where needed to validate actual responses. These reruns were not executed.

Risk assessment — 36/100 · Medium

The Medium rating is driven by public CLI behavior, cross-component scope.

Change scope: 81 changed files, 94691 changed lines (+32518 / -62173), including 4 production files.
Affected components: keyvault, servicefabric
Risk drivers: public CLI behavior (+18); cross-component scope (+5)
Regression evidence: Changed regression tests are included, reducing risk.
Confidence: High because changed-line patches were available for every production file.
Required review: Owning-squad review is recommended for keyvault, servicefabric before merge.

Posted by x-engineering-agent (Reviewer)

JaysonTaiMicrosoft · 2026-10-23T06:51:55Z

neerjagangwar The keyvault sdk is a dependency for multiple modules. Please ensure that recording files for dependent scenarios are properly re-recorded. Please refer to https://github.com/Azure/azure-cli/blob/dev/doc/authoring_tests.md#recording-tests for extra guidance.

Yeming Liu (isra-fel)

Consulted Ethan Yang and we both agreed the MS Graph Profile Replacer is good to go unless it breaks existing test cases which rely on unsanitized data.

neerja581 and others added 4 commits October 11, 2026 15:56

[ServiceFabric] Pass required sku family when creating Key Vault

39c4672

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

[Key Vault] Re-record tests live against api-version 2026-05-15

9fb2862

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

Copilot AI balanced review requested due to automatic review settings October 16, 2026 14:26

neerjagangwar requested review from a team as code owners October 16, 2026 14:26

microsoft-github-policy-service Bot requested review from Yu Chen (jsntcy), ZelinWang (wangzelin007) and Yong Zhang (yonzhan) October 16, 2026 14:27

Copilot started reviewing on behalf of neerjagangwar October 16, 2026 14:27

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

Comment thread src/azure-cli-testsdk/azure/cli/testsdk/utilities.py Outdated

Comment thread src/azure-cli/setup.py Outdated

Comment thread src/azure-cli-testsdk/azure/cli/testsdk/utilities.py Outdated

x-engineering-agent Bot added this to the November 2026 (2026-11-03) milestone Oct 16, 2026

[Key Vault] Merge upstream dev and move azure-mgmt-keyvault pin to py…

f03e6b0

…project.toml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39

neerja581 and others added 2 commits October 19, 2026 12:47

neerjagangwar requested a review from FumingZhang as a code owner October 19, 2026 11:55

neerja581 and others added 2 commits October 20, 2026 19:18

JaysonTaiMicrosoft added the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 23, 2026

x-engineering-agent Bot added the X Engineering Agent Reviewed Agent reviewed this PR label Oct 23, 2026

Yeming Liu (isra-fel) approved these changes Oct 23, 2026

View reviewed changes

Conversation

neerjagangwar commented Oct 16, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ️✔️ All clear

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Yong Zhang (yonzhan) commented Oct 16, 2026

Uh oh!

azure-pipelines Bot commented Oct 16, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 19, 2026

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 20, 2026

Uh oh!

azure-pipelines Bot commented Oct 20, 2026

Uh oh!

neerjagangwar commented Oct 20, 2026

Uh oh!

azure-pipelines Bot commented Oct 20, 2026

Uh oh!

Alex Wang (Alex-AZPS) commented Oct 20, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 21, 2026

Uh oh!

azure-pipelines Bot commented Oct 21, 2026

Uh oh!

x-engineering-agent Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

X Engineering Agent Report

Uh oh!

JaysonTaiMicrosoft commented Oct 23, 2026

Uh oh!

Yeming Liu (isra-fel) left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

neerjagangwar commented Oct 16, 2026 •

edited by x-engineering-agent Bot

Loading

x-engineering-agent Bot commented Oct 23, 2026 •

edited

Loading