Merge 3.2.1 to main by indrora · Pull Request #76 · Keyfactor/azurekeyvault-orchestrator

indrora · 2026-03-09T20:43:18Z

Merge release-3.2 to main - Automated PR

…should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>

Added entry parameter to indicate the private key should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> --------- Co-authored-by: Joe VanWanzeele <76071503+joevanwanzeeleKF@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * cleaned up docs, split RBAC permissions into seperate file for brevity * Update generated docs * Updated changelog, nuget package references * Explicit update of Newtonsoft.Json.Bson from 1.0.2 (used by Microsoft.AspNet.WebApi.Client) to 1.0.3 to address vulnerability --------- Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>

Copilot

Pull request overview

This automated merge brings the release-3.2 line into main, updating the Azure Key Vault orchestrator to support a new “NonExportable” entry parameter and reorganizing RBAC/migration documentation.

Changes:

Added a NonExportable entry parameter and plumbed it through the management job into Azure Key Vault certificate import policy.
Refactored and expanded documentation, including moving detailed RBAC guidance into a new rbac.md.
Updated NuGet dependencies for the orchestrator project.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 21 comments.

Show a summary per file

File	Description
rbac.md	New RBAC guidance and sample role definitions.
integration-manifest.json	Adds `NonExportable` entry parameter to the manifest.
docsource/content.md	Documentation restructure; references RBAC doc.
README.md	Documentation restructure; adds `NonExportable` docs and reworks discovery/store creation sections.
CHANGELOG.md	Adds 3.2.x entries and notes package/doc updates.
AzureKeyVault/Jobs/Management.cs	Reads `NonExportable` and passes it into import flow.
AzureKeyVault/Constants.cs	Adds `EntryParameters.NON_EXPORTABLE`.
AzureKeyVault/AzureClient.cs	Applies `Exportable` policy based on `NonExportable` during import.
AzureKeyVault/AzureKeyVault.csproj	Updates package versions and adds new dependency.
AzureKeyVault.sln	Adds `rbac.md` to solution items.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-09T20:48:08Z

README.md

+1) [Configure client access; permissions and authentication](#configure-the-azure-keyvault-for-client-access)

-1) [Configure the Azure Keyvault for client access](#configure-the-azure-keyvault-for-client-access)
-
-1) [Create the Store Type in Keyfactor](#create-the-akv-certificate-store-type)
+1) [Create the Store Type in Keyfactor](#AKV-Certificate-Store-Type)



The TOC link fragment #AKV-Certificate-Store-Type likely doesn’t match GitHub’s generated heading id for ## AKV Certificate Store Type (which is typically lowercase, e.g. #akv-certificate-store-type). This link may be broken; update the fragment to the exact rendered heading id.

Copilot · 2026-03-09T20:48:08Z

README.md

 management operations. For more information and a comparison of the two access control strategies, refer
 to [this article](learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy).


This markdown link is missing a URL scheme (https://). As written, learn.microsoft.com/... will be treated as a relative link and will be broken on GitHub; update it to https://learn.microsoft.com/....

Copilot · 2026-03-09T20:48:09Z

README.md

+1) Enter commma seperated list of tenant ID's in the "Directories to search" field.'
+


Typo/grammar: “commma seperated list of tenant ID's … field.'” contains multiple spelling issues and an extraneous trailing quote. Please correct the spelling (“comma-separated”, “tenant IDs”) and remove the stray '.

Copilot · 2026-03-09T20:48:09Z

README.md

+When the Discovery job runs successfully, it will list the existing Azure Keyvaults that are acessible by our service
+principal.


Typo: “acessible” should be “accessible”.

Copilot · 2026-03-09T20:48:09Z

README.md

   | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` |
-   | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` |
-   | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
-   | `11.6` _and_ newer | `net8.0` | | `net8.0` |
+   | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` || Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
+   | `11.6` _and_ newer | `net8.0` | | `net8.0` | 


The compatibility matrix table row appears to have two rows accidentally concatenated with ||, which will break table rendering. Split this into two separate table rows so the matrix displays correctly.

Copilot · 2026-03-09T20:48:12Z

rbac.md

+        "description": "This role contains all of the necessary permissions to perform Inventory, Add and Remove operations on certificates on All KeyVaults within a Resource Group.  It also contains sufficient permissions to create a new KeyVault within the resource group.",
+        "assignableScopes": [
+          "/subscriptions/{subscriptionId1}", // allow to be applied to a specific subscription
+          "/subscriptions/{subscriptionId2}", // and another.. etc.
+          "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}", // allow to be scoped to a specific resource group
+          "/subscriptions/{subscriptionId2}/resourcegroups/{resourceGroupName2}", // and another.. 
+          "/providers/Microsoft.Management/managementGroups/{groupId1}" // allow to be applied for all subscriptions under management group           
+        ],


The custom role “JSON” examples include // comments and trailing commas (e.g., in assignableScopes), which are not valid JSON for Azure role definitions and will fail if copied directly into the portal/CLI. Consider removing the comments/trailing commas (or explicitly note that they must be removed) to make the examples copy/pasteable.

Copilot · 2026-03-09T20:48:12Z

docsource/content.md

+1) [Configure client access; permissions and authentication](#configure-the-azure-keyvault-for-client-access)

-1) [Configure the Azure Keyvault for client access](#configure-the-azure-keyvault-for-client-access)
-
-1) [Create the Store Type in Keyfactor](#create-the-akv-certificate-store-type)
+1) [Create the Store Type in Keyfactor](#AKV-Certificate-Store-Type)



The TOC link fragment #AKV-Certificate-Store-Type likely doesn’t match the generated heading id for ## AKV Certificate Store Type (typically lowercase, e.g. #akv-certificate-store-type). This link may be broken; update it to the exact rendered id.

Copilot · 2026-03-09T20:48:12Z

docsource/content.md

+It allows the assignment of granular level, inheretable access control on both the contents of the KeyVaults, as well as higher-level
 management operations. For more information and a comparison of the two access control strategies, refer
 to [this article](learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy).


This markdown link is missing a URL scheme (https://). As written, learn.microsoft.com/... will be treated as a relative link and will be broken on GitHub; update it to https://learn.microsoft.com/....

Copilot · 2026-03-09T20:48:12Z

rbac.md

+                    "Microsoft.Authorization/roleAssignments/*",                     
+                    "Microsoft.KeyVault/operations/read"                                
+                    "Microsoft.KeyVault/locations/*/read",
+                    "Microsoft.KeyVault/vaults/*/read",


The sample role definition has a syntax error: there is a missing comma between the Microsoft.KeyVault/operations/read and Microsoft.KeyVault/locations/*/read entries, which makes the example invalid even as JavaScript. Add the comma so the sample can be copied without errors.

Copilot · 2026-03-09T20:48:13Z

CHANGELOG.md

+  - Added an optional entry parameter to indicate whether the private key of the cert should be not exportable when stored in KeyVault
+  - Now specifying the pkcs12 format when wirting certs to Azure KeyVault.  This should prevent the error when a PEM cert was added outside of Command and then we attempt to update without specifying the format (Azure assumes PEM and throws an error if not).


Spelling: “wirting” should be “writing”.

indrora and others added 3 commits January 13, 2026 15:24

chore: create 3.2 branch

a225e59

feat: release 3.2, Added entry parameter to indicate the private key …

85e3cf0

…should not be exportable from KeyVault Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>

Copilot AI review requested due to automatic review settings March 9, 2026 20:43

Copilot started reviewing on behalf of indrora March 9, 2026 20:43 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

Merge branch 'main' into fixup-release-3.2

34b8026

indrora merged commit 62316c4 into main Mar 16, 2026
18 of 20 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge 3.2.1 to main#76

Merge 3.2.1 to main#76
indrora merged 4 commits intomainfrom
fixup-release-3.2

indrora commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		management operations. For more information and a comparison of the two access control strategies, refer
		to [this article](learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy).

		1) Enter commma seperated list of tenant ID's in the "Directories to search" field.'

		When the Discovery job runs successfully, it will list the existing Azure Keyvaults that are acessible by our service
		principal.

		- Added an optional entry parameter to indicate whether the private key of the cert should be not exportable when stored in KeyVault
		- Now specifying the pkcs12 format when wirting certs to Azure KeyVault. This should prevent the error when a PEM cert was added outside of Command and then we attempt to update without specifying the format (Azure assumes PEM and throws an error if not).

Conversation

indrora commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants