[Announcement] Key Vault: control plane API versions before 2026-02-01 retire on Feb 27, 2027 — action required

[Alex-AZPS]

📌 Action Required: Azure Key Vault control plane API versions before 2026-02-01 retire on February 27, 2027

Azure Key Vault is retiring all control plane (management) API versions released before 2026-02-01, effective February 27, 2027. Starting on that date, Key Vault management requests (create/update/delete vault, network rules, access-control changes, etc.) made with an older control plane API version will no longer be served.

This does not affect the data plane. Reading/writing secrets, keys, and certificates (Get-AzKeyVaultSecret, Get-AzKeyVaultKey, Get-AzKeyVaultCertificate, etc.) is not impacted — only vault management (control plane) operations are affected by this retirement.

What you need to do

• Upgrade the Az.KeyVault module to 6.6.0 or later: Update-Module Az -Force. If you don't have Azure PowerShell installed yet, or need install instructions, see Install Azure PowerShell.
• If you call the Key Vault management REST API directly, or use ARM/Bicep/Terraform templates, update to api-version=2026-02-01 or later

Also starting with API version 2026-02-01

Azure RBAC becomes the default access-control model for newly created key vaults using this API version (enableRbacAuthorization = true by default). This does not change any existing vault's access-control model — only the default for new-vault creation. Access policies remain fully supported; pass -DisableRbacAuthorization at creation time if you want a new vault to keep using access policies.

Reference

Full details, migration guidance, and FAQ: https://aka.ms/keyvault-api-update

---

This issue is pinned for visibility. Please reach out in this thread or open a new issue if you have questions about upgrading.