Microsoft.KeyVault vaults 2016-10-01

Bicep resource definition

The vaults resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.KeyVault/vaults resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.KeyVault/vaults@2016-10-01' = {
  location: 'string'
  name: 'string'
  properties: {
    accessPolicies: [
      {
        applicationId: 'string'
        objectId: 'string'
        permissions: {
          certificates: [
            'string'
          ]
          keys: [
            'string'
          ]
          secrets: [
            'string'
          ]
          storage: [
            'string'
          ]
        }
        tenantId: 'string'
      }
    ]
    createMode: 'string'
    enabledForDeployment: bool
    enabledForDiskEncryption: bool
    enabledForTemplateDeployment: bool
    enablePurgeProtection: bool
    enableSoftDelete: bool
    sku: {
      family: 'string'
      name: 'string'
    }
    tenantId: 'string'
    vaultUri: 'string'
  }
  tags: {
    {customized property}: 'string'
  }
}

Property values

AccessPolicyEntry

Microsoft.KeyVault/vaults

Permissions

Sku

VaultCreateOrUpdateParametersTags

VaultProperties

Quickstart samples

The following quickstart samples deploy this resource type.

ARM template resource definition

The vaults resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.KeyVault/vaults resource, add the following JSON to your template.

{
  "type": "Microsoft.KeyVault/vaults",
  "apiVersion": "2016-10-01",
  "name": "string",
  "location": "string",
  "properties": {
    "accessPolicies": [
      {
        "applicationId": "string",
        "objectId": "string",
        "permissions": {
          "certificates": [ "string" ],
          "keys": [ "string" ],
          "secrets": [ "string" ],
          "storage": [ "string" ]
        },
        "tenantId": "string"
      }
    ],
    "createMode": "string",
    "enabledForDeployment": "bool",
    "enabledForDiskEncryption": "bool",
    "enabledForTemplateDeployment": "bool",
    "enablePurgeProtection": "bool",
    "enableSoftDelete": "bool",
    "sku": {
      "family": "string",
      "name": "string"
    },
    "tenantId": "string",
    "vaultUri": "string"
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property values

AccessPolicyEntry

Microsoft.KeyVault/vaults

Permissions

Sku

VaultCreateOrUpdateParametersTags

VaultProperties

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
AKS Cluster with a NAT Gateway and an Application Gateway	This sample shows how to a deploy an AKS cluster with NAT Gateway for outbound connections and an Application Gateway for inbound connections.
AKS cluster with the Application Gateway Ingress Controller	This sample shows how to deploy an AKS cluster with Application Gateway, Application Gateway Ingress Controller, Azure Container Registry, Log Analytics and Key Vault
App Service Environment with Azure SQL backend	This template creates an App Service Environment with an Azure SQL backend along with private endpoints along with associated resources typically used in an private/isolated environment.
Application Gateway with internal API Management and Web App	Application Gateway routing Internet traffic to a virtual network (internal mode) API Management instance which services a web API hosted in an Azure Web App.
Azure AI Studio basic setup	This set of templates demonstrates how to set up Azure AI Studio with the basic setup, meaning with public internet access enabled, Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio basic setup	This set of templates demonstrates how to set up Azure AI Studio with the basic setup, meaning with public internet access enabled, Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio basic setup	This set of templates demonstrates how to set up Azure AI Studio with the basic setup, meaning with public internet access enabled, Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio Network Restricted	This set of templates demonstrates how to set up Azure AI Studio with private link and egress disabled, using Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio Network Restricted	This set of templates demonstrates how to set up Azure AI Studio with private link and egress disabled, using Microsoft-managed keys for encryption and Microsoft-managed identity configuration for the AI resource.
Azure AI Studio with Microsoft Entra ID Authentication	This set of templates demonstrates how to set up Azure AI Studio with Microsoft Entra ID authentication for dependent resources, such as Azure AI Services and Azure Storage.
Azure Function app and an HTTP-triggered function	This example deploys an Azure Function app and an HTTP-triggered function inline in the template. It also deploys a Key Vault and populates a secret with the function app's host key.
Azure Machine Learning end-to-end secure setup	This set of Bicep templates demonstrates how to set up Azure Machine Learning end-to-end in a secure set up. This reference implementation includes the Workspace, a compute cluster, compute instance and attached private AKS cluster.
Azure Machine Learning end-to-end secure setup (legacy)	This set of Bicep templates demonstrates how to set up Azure Machine Learning end-to-end in a secure set up. This reference implementation includes the Workspace, a compute cluster, compute instance and attached private AKS cluster.
Azure Machine Learning Workspace	This template creates a new Azure Machine Learning Workspace, along with an encrypted Storage Account, KeyVault and Applications Insights Logging
Azure Storage Account Encryption with customer-managed key	This template deploys a Storage Account with a customer-managed key for encryption that's generated and placed inside a Key Vault.
Connect to a Key Vault via private endpoint	This sample shows how to use configure a virtual network and private DNS zone to access Key Vault via private endpoint.
Create a Key Vault and a list of secrets	This template creates a Key Vault and a list of secrets within the key vault as passed along with the parameters
Create a KeyVault	This module creates a KeyVault resource with apiVersion 2019-09-01.
Create a new encrypted windows vm from gallery image	This template creates a new encrypted windows vm using the server 2k12 gallery image.
Create a Private AKS Cluster with a Public DNS Zone	This sample shows how to a deploy a private AKS cluster with a Public DNS Zone.
Create AML workspace with multiple Datasets & Datastores	This template creates Azure Machine Learning workspace with multiple datasets & datastores.
Create an AKS compute target with a Private IP address	This template creates an AKS compute target in given Azure Machine Learning service workspace with a private IP address.
Create an API Management service with SSL from KeyVault	This template deploys an API Management service configured with User Assigned Identity. It uses this identity to fetch SSL certificate from KeyVault and keeps it updated by checking every 4 hours.
Create an Application Gateway V2 with Key Vault	This template deploys an Application Gateway V2 in a Virtual Network, a user defined identity, Key Vault, a secret (cert data), and access policy on Key Vault and Application Gateway.
Create an Azure Key Vault and a secret	This template creates an Azure Key Vault and a secret.
Create an Azure Key Vault with RBAC and a secret	This template creates an Azure Key Vault and a secret. Instead of relying on access policies, it leverages Azure RBAC to manage authorization on secrets
Create an Azure Machine Learning service workspace	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the minimal set of resources you require to get started with Azure Machine Learning.
Create an Azure Machine Learning service workspace (CMK)	This deployment template specifies how to create an Azure Machine Learning workspace with service-side encryption using your encryption keys.
Create an Azure Machine Learning service workspace (CMK)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. The example shows how to configure Azure Machine Learning for encryption with a customer-managed encryption key.
Create an Azure Machine Learning service workspace (legacy)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the set of resources you require to get started with Azure Machine Learning in a network isolated set up.
Create an Azure Machine Learning service workspace (vnet)	This deployment template specifies an Azure Machine Learning workspace, and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. This configuration describes the set of resources you require to get started with Azure Machine Learning in a network isolated set up.
Create and encrypt a new Windows VMSS with jumpbox	This template allows you to deploy a simple VM Scale Set of Windows VMs using the lastest patched version of serveral Windows versions. This template also deploys a jumpbox with a public IP address in the same virtual network. You can connect to the jumpbox via this public IP address, then connect from there to VMs in the scale set via private IP addresses.This template enables encryption on the VM Scale Set of Windows VMs.
Create Application Gateway with Certificates	This template shows how to generate Key Vault self-signed certificates, then reference from Application Gateway.
Create Key Vault with logging enabled	This template creates an Azure Key Vault and an Azure Storage account that is used for logging. It optionally creates resource locks to protect your Key Vault and storage resources.
Create key vault, managed identity, and role assignment	This template creates a key vault, managed identity, and role assignment.
Create new encrypted managed disks win-vm from gallery image	This template creates a new encrypted managed disks windows vm using the server 2k12 gallery image.
Creates a Cross-tenant Private Endpoint resource	This template allows you to create Priavate Endpoint resource within the same or cross-tenant environment and add dns zone configuration.
Creates a Dapr pub-sub servicebus app using Container Apps	Create a Dapr pub-sub servicebus app using Container Apps.
creates an Azure Stack HCI 23H2 cluster	This template creates an Azure Stack HCI 23H2 cluster using an ARM template, using custom storage IP
creates an Azure Stack HCI 23H2 cluster	This template creates an Azure Stack HCI 23H2 cluster using an ARM template.
creates an Azure Stack HCI 23H2 cluster in Switchless-Dual-link Networking mode	This template creates an Azure Stack HCI 23H2 cluster using an ARM template.
creates an Azure Stack HCI 23H2 cluster in Switchless-SingleLink networking mode	This template creates an Azure Stack HCI 23H2 cluster using an ARM template.
Deploy Secure Azure AI Studio with a managed virtual network	This template creates a secure Azure AI Studio environment with robust network and identity security restrictions.
Deploy the Sports Analytics on Azure Architecture	Creates an Azure storage account with ADLS Gen 2 enabled, an Azure Data Factory instance with linked services for the storage account (an the Azure SQL Database if deployed), and an Azure Databricks instance. The AAD identity for the user deploying the template and the managed identity for the ADF instance will be granted the Storage Blob Data Contributor role on the storage account. There are also options to deploy an Azure Key Vault instance, an Azure SQL Database, and an Azure Event Hub (for streaming use cases). When an Azure Key Vault is deployed, the data factory managed identity and the AAD identity for the user deploying the template will be granted the Key Vault Secrets User role.
Enable encryption on a running Windows VM	This template enables encryption on a running windows vm.
FinOps hub	This template creates a new FinOps hub instance, including Data Lake storage and a Data Factory.
Testing environment for Azure Firewall Premium	This template creates an Azure Firewall Premium and Firewall Policy with premium features such as Intrusion Inspection Detection (IDPS), TLS inspection and Web Category filtering
This template encrypts a running Windows VMSS	This template enables encryption on a running Windows VM Scale Set
upgrades an Azure Stack HCI 22H2 cluster to 23H2 cluster	This template upgrades an Azure Stack HCI 22H2 cluster to 23H2 cluster using an ARM template.

Terraform (AzAPI provider) resource definition

The vaults resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.KeyVault/vaults resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.KeyVault/vaults@2016-10-01"
  name = "string"
  location = "string"
  tags = {
    {customized property} = "string"
  }
  body = jsonencode({
    properties = {
      accessPolicies = [
        {
          applicationId = "string"
          objectId = "string"
          permissions = {
            certificates = [
              "string"
            ]
            keys = [
              "string"
            ]
            secrets = [
              "string"
            ]
            storage = [
              "string"
            ]
          }
          tenantId = "string"
        }
      ]
      createMode = "string"
      enabledForDeployment = bool
      enabledForDiskEncryption = bool
      enabledForTemplateDeployment = bool
      enablePurgeProtection = bool
      enableSoftDelete = bool
      sku = {
        family = "string"
        name = "string"
      }
      tenantId = "string"
      vaultUri = "string"
    }
  })
}

Property values

AccessPolicyEntry

Microsoft.KeyVault/vaults

Permissions

Sku

VaultCreateOrUpdateParametersTags

VaultProperties