Retirement of Key Vault APIs <2026-02-01

[julrich-bee360]

Microsoft announced that they will retire the Azure Key Vault API versions below 2026-02-01 on February 27, 2027:

Warning

Starting February 2026, Azure Key Vault API version 2026-02-01 establishes Azure RBAC as the default access control model. All API versions before 2026-02-01 retire on February 27, 2027.

See also:

• https://learn.microsoft.com/en-us/azure/key-vault/general/access-control-default?tabs=azure-cli
• https://learn.microsoft.com/en-us/answers/questions/5761802/prepare-for-key-vault-api-version-2026-02-01-azure

I guess there is not much to do for AzureSignTool except for updating the versions of the Azure.Security.KeyVault.Certificates and Azure.Security.KeyVault.Keys packages. However, Microsoft did not yet release an updated version of these packages. So I assume the current version (4.8.0 at the time of writing) does not yet support the new API versions.

So for now, this issue is just a note in advance.

[grossag]

@julrich-bee360 some of my coworkers were concerned about this too but I am starting to think that this API version change will not affect AzureKeyVault. https://learn.microsoft.com/en-us/azure/key-vault/general/access-control-default?tabs=azure-cli says:

All Key Vault control plane API versions before 2026-02-01 retire on February 27, 2027. Your key vaults will continue to exist and only be accessible with control plane API versions 2026-02-01 or later. Data plane APIs are not affected.

My understanding is that AzureSignTool only uses the data plane APIs. Thoughts?