az keyvault create removes existing access policies

[Cam-Borrowell]

If I run the command az keyvault create on an existing resource, the existing access policies are removed and replaced with a new one for the Azure DevOps project that ran the script.

azure-cli                          2.3.1 *

command-modules-nspkg              2.0.3
core                               2.3.1 *
nspkg                              3.0.4
telemetry                          1.0.4

Extensions:
azure-devops                      0.18.0

[yonzhan]

@bim-msft please take a look

[yungezz]

this is service idempotent issue. let's feedback and see what's right solution @bim-msft

[bim-msft]

@Cam-Borrowell Hi, according to our test, it turns out that the KeyVault service for creating operation is not idempotent. I'm not sure if service team is willing to change this behavior, or it might take a long time to change... I will let them know. Thanks for the report!

For short term to unblock you quickly, using update command is recommended to update vault properties, and you can use show command to check if there is already an existing vault with the same name.

Feel free to let me know if you have any concern.

[Cam-Borrowell]

Thank you @bim-msft . I've already implemented a workaround using az keyvault list to check for an existing Key Vault before running az keyvault create

[bim-msft]

@Cam-Borrowell Good to hear that!
Since this might take a long time to change, I would like to close the issue temporarily. If you have anything unresolved, feel free to reopen it and ping me again.