Az breaking change to split certificates from Get-AzKeyVaultSecret

[insomniacc]

Description

As per the discussion title, the up coming breaking change to Az.Keyvault, see:
https://learn.microsoft.com/en-us/powershell/azure/upcoming-breaking-changes?view=azps-15.6.0#get-azkeyvaultsecret

States that certificates will be split out into their own cmdlet.
Is this change being lined up with a change the to Secrets Management Module to ensure that there's no impact?

Apologies if this has already been raised, I couldnt see any other issues or documentation about this.

WARNING: Upcoming breaking changes in the cmdlet 'Get-AzKeyVaultSecret' :
Certificate-backed secrets will no longer be returned when listing secrets. Use the certificate cmdlets (Get-AzKeyVaultCertificate) to manage these secrets.
- The change is expected to take effect in Az version : '16.0.0'
- The change is expected to take effect in Az.KeyVault version : '7.0.0'

Script or Debug output

Environment data

Module versions

Error output

[isra-fel]

Thank you for raising this, @insomniacc! This is a great question.

The upcoming breaking change in Az.KeyVault 7.0 will separate certificate-backed secrets from Get-AzKeyVaultSecret, directing users to Get-AzKeyVaultCertificate instead.

We are reviewing the impact on related modules, including the SecretManagement extension vault. We will follow up here with a detailed customer-ready statement covering the scope of the change and any actions needed on your side.

In the meantime, could you share which specific workflows you rely on? For example, are you using Get-Secret via the Az.KeyVault vault extension to retrieve certificate-backed secrets? This will help us ensure the transition is smooth for your scenario.

[insomniacc]

@isra-fel - I use it to register the keyvault (Register-SecretVault) within my PowerShell Universal instance which uses the SecretManagement module behind the scenes to pull and load secrets into the platform. So I don't explicitly 'Get-Secret' myself, but the product does behind the scenes whenever I need to import or use a secret from Az keyvault.
In my case I have a stored certificate in Keyvault and pull that through to authenticate against Sharepoint Online (using the PnPOnline module via an app registration) within PSU. I've raised this also with Devolutions who own the product, so that theyre aware, but they have advised it should be fine, providing the SecretManagement module is updated inline with the changes to Az.Keyvault