|
Deadline: February 27, 2027 All Azure Key Vault control plane (management) API versions released before 2026-02-01 will stop working on February 27, 2027. This does NOT affect the data plane (getting/setting secrets, keys, and certificates) — only vault and access-control management operations are impacted. |
TL;DR — What you need to do
- Upgrade Azure CLI to 2.90.0 or later (run az upgrade).
- Upgrade Az PowerShell's Az.KeyVault module to 6.6.1 or later, or upgrade the Az package to 16.3.0 or later.
- Do this before February 27, 2027 to avoid any interruption to vault management operations.
- No data plane changes are required — reading/writing secrets, keys, and certificates is unaffected.
- For details, see Prepare for Key Vault API version 2026-02-01 and later.
What is changing
Current releases of Azure CLI 2.90.0 or later and Az PowerShell 16.3.0 or later (including Az.KeyVault 6.6.1 or later) already use Key Vault control plane API version 2026-02-01. Upgrade to these versions before February 27, 2027; after that date, earlier control plane API versions will no longer be served.
Who is affected
You are affected if you use either of the following:
- Azure CLI scripts or automation that call az keyvault management commands (create, update, network-rule, access-policy, etc.).
- Az PowerShell scripts that use the Az.KeyVault module's management cmdlets (New-AzKeyVault, Set-AzKeyVault, Update-AzKeyVault, etc.).
Minimum versions to upgrade to
|
Tool / SDK |
Minimum version |
How to upgrade |
|
Azure CLI |
az upgrade | |
|
Az PowerShell (Az.KeyVault module) |
Update-Module Az -Force |
Impact if you take no action
|
What breaks on and after February 27, 2027 if you have not upgraded Key Vault management operations (create/update/delete vault, change network rules, change access policies or RBAC settings, etc.) issued with a pre-2026-02-01 API version will fail. You’ll get the following error message: “Due to an RBAC security default, Key Vault's Resource Manager API versions older than 2026-02-01 will retire on 2027-04-01.” Your vaults are NOT deleted and existing secrets/keys/certificates remain fully accessible via the data plane — only management (control plane) operations are blocked. There is no way to opt out or request an extension once the retirement takes effect on February 27, 2027. |
How to check your installed versions
Check your Azure CLI version
Run the following command:
az version
Check the azure-cli value. If the installed version is earlier than 2.90.0, upgrade Azure CLI before February 27, 2027 by running az upgrade.
Check your Az PowerShell version
Run the following commands:
Get-InstalledModule Az, Az.KeyVault | Select-Object Name, Version
If Az.KeyVault is earlier than 6.6.1, or the installed Az package is earlier than 16.3.0, upgrade before February 27, 2027. To upgrade the complete Az package, run:
Update-Module Az -Force
Alternatively, to update only the Az.KeyVault module to the latest version, run:
Update-Module Az.KeyVault -Force
Timeline
|
Date |
Milestone |
|
March 2026 |
Control plane API version 2026-02-01 generally available across public Azure regions, Azure Government, and Azure operated by 21Vianet. |
|
Today → February 27, 2027 |
Preparation window. Upgrade to Azure CLI 2.90.0 or later, Az.KeyVault 6.6.1 or later, or Az 16.3.0 or later before February 27, 2027. |
|
February 27, 2027 |
All control plane API versions released before 2026-02-01 are retired and stop being served. |
Questions?
For any questions about Azure CLI or Azure PowerShell, please submit feedback through GitHub:
Microsoft