diff --git a/sdk/security/keyvault/azsecrets/CHANGELOG.md b/sdk/security/keyvault/azsecrets/CHANGELOG.md
index 1d40357c0591..5cc460f9d187 100644
--- a/sdk/security/keyvault/azsecrets/CHANGELOG.md
+++ b/sdk/security/keyvault/azsecrets/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Features Added
 
 ### Breaking Changes
+* changed type of `KID` from string to type `ID`
 
 ### Bugs Fixed
 
diff --git a/sdk/security/keyvault/azsecrets/autorest.md b/sdk/security/keyvault/azsecrets/autorest.md
index 3226bac85eb5..6957d886c0f3 100644
--- a/sdk/security/keyvault/azsecrets/autorest.md
+++ b/sdk/security/keyvault/azsecrets/autorest.md
@@ -123,6 +123,9 @@ directive:
   - from: models.go
     where: $
     transform: return $.replace(/(\sID \*)string(\s+.*)/g, "$1ID$2")
+  - from: models.go
+    where: $
+    transform: return $.replace(/(\sKID \*)string(\s+.*)/g, "$1ID$2")
 
   # Maxresults -> MaxResults
   - from:
diff --git a/sdk/security/keyvault/azsecrets/models.go b/sdk/security/keyvault/azsecrets/models.go
index 232c44f56118..efd8b359e31a 100644
--- a/sdk/security/keyvault/azsecrets/models.go
+++ b/sdk/security/keyvault/azsecrets/models.go
@@ -105,7 +105,7 @@ type DeletedSecret struct {
 
 	// READ-ONLY; If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV
 	// certificate.
-	KID *string `json:"kid,omitempty" azure:"ro"`
+	KID *ID `json:"kid,omitempty" azure:"ro"`
 
 	// READ-ONLY; True if the secret's lifetime is managed by key vault. If this is a secret backing a certificate, then managed
 	// will be true.
@@ -178,7 +178,7 @@ type Secret struct {
 
 	// READ-ONLY; If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV
 	// certificate.
-	KID *string `json:"kid,omitempty" azure:"ro"`
+	KID *ID `json:"kid,omitempty" azure:"ro"`
 
 	// READ-ONLY; True if the secret's lifetime is managed by key vault. If this is a secret backing a certificate, then managed
 	// will be true.