You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If specified, 'soft delete' functionality is enabled for this key vault.
99
+
Specifies that the soft-delete functionality is enabled for this key vault. When soft-delete is enabled, for a grace period, you can recover this key vault and its contents after it is deleted.
100
+
101
+
For more information about this functionality, see [Azure Key Vault soft-delete overview](https://docs.microsoft.com/azure/key-vault/key-vault-ovw-soft-delete). For how-to instructions, see [How to use Key Vault soft-delete with PowerShell](https://docs.microsoft.com/azure/key-vault/key-vault-soft-delete-powershell).
Specifies the Azure region in which to create the key vault. Use the command Get-AzureLocation
115
-
(https://msdn.microsoft.com/ library/azure/mt589064.aspx) to see your choices. For more
116
-
information, type `Get-Help Get-AzureLocation`.
116
+
Specifies the Azure region in which to create the key vault. Use the command [Get-AzureLocation](https://docs.microsoft.com/powershell/module/Azure/Get-AzureLocation) to see your choices.
Specifies the SKU of the key vault instance. For information about which features are available for
147
-
each SKU, see the Azure Key Vault Pricing website (http://go.microsoft.com/fwlink/?linkid=512521).
146
+
Specifies the SKU of the key vault instance. For information about which features are available for each SKU, see the Azure Key Vault Pricing website (https://go.microsoft.com/fwlink/?linkid=512521).
148
147
149
148
```yaml
150
149
Type: SkuName
@@ -239,4 +238,4 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable
The **Set-AzureRmKeyVaultAccessPolicy** cmdlet grants or modifies existing permissions for a user, application, or security group to perform the specified operations with a key vault.
55
-
It does not modify the permissions that other users, applications, or security groups have on the key vault.
54
+
The **Set-AzureRmKeyVaultAccessPolicy** cmdlet grants or modifies existing permissions for a user, application, or security group to perform the specified operations with a key vault. It does not modify the permissions that other users, applications, or security groups have on the key vault.
56
55
57
56
If you are setting permissions for a security group, this operation affects only users in that security group.
58
57
@@ -72,7 +71,7 @@ Note that although specifying the resource group is optional for this cmdlet, yo
72
71
73
72
## EXAMPLES
74
73
75
-
### Example 1: Grant permissions to a user for a key vault Key Vault and modify the permissionskey vault
74
+
### Example 1: Grant permissions to a user for a key vault Key Vault and modify the permissions
The first command grants permissions for a user in your Azure Active Directory, [email protected], to perform operations on keys and secrets with a key vault named Contoso03Vault.
83
82
84
-
The second command modifies the permissions that were granted to [email protected] in the first command, to now allow getting secrets in addition to setting and deleting them.
85
-
The permissions to key operations remain unchanged after this command.
86
-
The *PassThru* parameter results in the updated object being returned by the cmdlet.
83
+
The second command modifies the permissions that were granted to [email protected] in the first command, to now allow getting secrets in addition to setting and deleting them. The permissions to key operations remain unchanged after this command. The *PassThru* parameter results in the updated object being returned by the cmdlet.
87
84
88
-
The final command further modifies the existing permissions for [email protected] to remove all permissions to key operations.
89
-
The permissions to secret operations remain unchanged after this command.
90
-
The *PassThru* parameter results in the updated object being returned by the cmdlet.
85
+
The final command further modifies the existing permissions for [email protected] to remove all permissions to key operations. The permissions to secret operations remain unchanged after this command. The *PassThru* parameter results in the updated object being returned by the cmdlet.
91
86
92
87
### Example 2: Grant permissions for an application service principal to read and write secrets
This command grants permissions for an application for a key vault named Contoso03Vault.
98
-
The *ServicePrincipalName* parameter specifies the application.
99
-
The applicationmust be registered in your Azure Active Directory.
100
-
The value of the *ServicePrincipalName* parameter must be either the service principal name of the application or the application ID GUID.
92
+
This command grants permissions for an application for a key vault named Contoso03Vault.
93
+
94
+
The *ServicePrincipalName* parameter specifies the application. The application must be registered in your Azure Active Directory. The value of the *ServicePrincipalName* parameter must be either the service principal name of the application or the application ID GUID.
95
+
101
96
This example specifies the service principal name http://payroll.contoso.com, and the command grants the application permissions to read and write secrets.
102
97
103
98
### Example 3: Grant permissions for an application using its object ID
This command grants the application permissions to read and write secrets.
104
+
109
105
This example specifies the application using the object ID of the service principal of the application.
110
106
111
107
### Example 4: Grant permissions for a user principal name
@@ -133,23 +129,21 @@ group2 b8a401eb-63ad-4a30
133
129
group3 da07a6be-2c1e-4e42-934d-ceb57cf652b4
134
130
```
135
131
136
-
The first command uses the Get-AzureRmADGroup cmdlet to get all Active Directory groups.
137
-
From the output, you see 3 groups returned, named **group1**, **group2**, and **group3**.
138
-
Multiple groups can have the same name but always have a unique ObjectId.
139
-
When more than one group that has the same name is returned, use the ObjectId in the output to identify the one you want to use.
132
+
The first command uses the Get-AzureRmADGroup cmdlet to get all Active Directory groups. From the output, you see 3 groups returned, named **group1**, **group2**, and **group3**. Multiple groups can have the same name but always have a unique ObjectId. When more than one group that has the same name is returned, use the ObjectId in the output to identify the one you want to use.
133
+
134
+
You then use the output of this command with Set-AzureRmKeyVaultAccessPolicy to grant permissions to group2 for your key vault, named **myownvault**. This example enumerates the groups named 'group2' inline in the same command line.
140
135
141
-
You then use the output of this command with Set-AzureRmKeyVaultAccessPolicy to grant permissions to group2 for your key vault, named **myownvault**.
142
-
This example enumerates the groups named 'group2' inline in the same command line.
143
136
There may be multiple groups in the returned list that are named 'group2'.
144
137
This example picks the first one, indicated by index \[0\] in the returned list.
145
138
146
139
### Example 7: Grant Azure Information Protection access to the customer-managed tenant key (BYOK)
This command authorizes Azure Information Protection to use a customer-managed key (the bring your own key, or "BYOK" scenario) as the Azure Information Protection tenant key.
152
-
When you run this command, specify your own vault name but you must specify the *ServicePrincipalName* parameter with the GUID **00000012-0000-0000-c000-000000000000** and specify all the permissions in the example.
145
+
146
+
When you run this command, specify your own key vault name but you must specify the *ServicePrincipalName* parameter with the GUID **00000012-0000-0000-c000-000000000000** and specify the permissions in the example.
Enables you to specify an object ID without validating that the object exists in Azure Active Directory.
167
+
173
168
Use this parameter only if you want to grant access to your key vault to an object ID that refers to a delegated security group from another Azure tenant.
Specifies the service principal name of the application to which to grant permissions.
402
-
Specify the application ID, also known as client ID, registered for the application in AzureActive Directory.
403
-
The application with the service principal name that this parameter specifies must be registered in the Azure directory that contains your current subscription.
399
+
400
+
Specify the application ID, also known as client ID, registered for the application in AzureActive Directory. The application with the service principal name that this parameter specifies must be registered in the Azure directory that contains your current subscription.
0 commit comments