Merge 3.2.3 to main

[indrora]

Merge release-3.2 to main - Automated PR

[Copilot]

Pull request overview

Automated merge of release-3.2 into main, primarily updating the Azure Key Vault orchestrator to enrich certificate import behavior (key metadata + exportability), extend store type entry parameters, and refresh accompanying documentation/scripts.

Changes:

• Added NonExportable entry parameter end-to-end (manifest, scripts, docs) and surfaced entry parameters in inventory results.
• Updated certificate import to derive key type/size from PFX and apply an explicit CertificatePolicy when importing into Azure Key Vault.
• Restructured documentation (RBAC guidance split to rbac.md, README updates) and added a dedicated unit test project.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
scripts/store_types/powershell/restmethod_create_store_types.ps1	New PowerShell REST script for creating the AKV store type.
scripts/store_types/powershell/kfutil_create_store_types.ps1	New kfutil-based PowerShell helper for creating the AKV store type.
scripts/store_types/bash/kfutil_create_store_types.sh	New kfutil-based bash helper for creating the AKV store type.
scripts/store_types/bash/curl_create_store_types.sh	New curl-based bash helper for creating the AKV store type (OAuth/basic auth).
README.md	Major documentation edits (RBAC guidance, discovery instructions, entry parameter docs, install matrix).
rbac.md	New standalone RBAC guidance and sample role definitions.
integration-manifest.json	Adds NonExportable entry parameter definition.
docsource/content.md	Mirrors README updates for generated docs.
CHANGELOG.md	Adds 3.2.x entries and notes key-size import fix.
AzureKeyVault/Jobs/Management.cs	Adds NonExportable handling and updates logging + sync-over-async calls.
AzureKeyVault/Jobs/Inventory.cs	Updates logging + sync-over-async call style; wording fixes.
AzureKeyVault/Jobs/Discovery.cs	Updates logging + count usage and truncation condition.
AzureKeyVault/Jobs/AzureKeyVaultJob.cs	Makes InitializeStore virtual; logger rename; adds InternalsVisibleTo for tests.
AzureKeyVault/Helpers.cs	Returns PKCS#12 bytes plus derived key type/size for imports.
AzureKeyVault/Constants.cs	Adds NON_EXPORTABLE constant.
AzureKeyVault/AzureKeyVault.csproj	Dependency updates and additions.
AzureKeyVault/AzureClient.cs	Applies explicit import policy (exportable/content type/key type/key size); returns entry params in inventory.
AzureKeyVault/AkvProperties.cs	Adjusts accessibility for internal properties.
AzureKeyVault.Tests/*	New unit test project validating management, discovery, inventory, and PKCS#12 conversion behavior.
AzureKeyVault.Tests/AzureKeyVault.Tests.csproj	New test project configuration and dependencies.
AzureKeyVault.sln	Adds rbac.md to solution items and includes the new test project.

Comments suppressed due to low confidence (9)

README.md:88

• The Markdown link target learn.microsoft.com/... is missing the https:// scheme, which makes it a relative link on GitHub. Use https://learn.microsoft.com/... so the reference resolves correctly.

management operations. For more information and a comparison of the two access control strategies, refer
to [this article](learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy).

README.md:596

• The compatibility matrix table row for 11.0.0–11.5.1/net8.0 is malformed: two rows appear to have been concatenated with || on a single line, which will break the Markdown table rendering. Split this back into two separate table rows.

   | --------- | ----------- | ----------- | ----------- |
   | Older than `11.0.0` | | | `net6.0` |
   | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` |
   | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` || Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
   | `11.6` _and_ newer | `net8.0` | | `net8.0` | 

README.md:563

• The example JSON for tags uses single quotes (e.g., {'tag-name': 'tag-content'}), which is not valid JSON. Update the example to use double quotes so users can copy/paste a valid JSON object.

   ##### Certificate Tags
   If desired, tags can be applied to the KeyVault entries.  Provide them as a JSON string of key-value pairs ie: '{'tag-name': 'tag-content', 'other-tag-name': 'other-tag-content'}'

docsource/content.md:42

• Typo: “inheretable” should be “inheritable”.

Based Access Control (RBAC) and the classic Access Policy method. RBAC is the preferred method, and currently the default used by Azure.
It allows the assignment of granular level, inheretable access control on both the contents of the KeyVaults, as well as higher-level
management operations. For more information and a comparison of the two access control strategies, refer

docsource/content.md:44

• The Markdown link target learn.microsoft.com/... is missing the https:// scheme, so it will render as a relative link. Use https://learn.microsoft.com/... to ensure it resolves correctly.

management operations. For more information and a comparison of the two access control strategies, refer
to [this article](learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy).

rbac.md:105

• The built-in role links use github.com/... without a URL scheme, which makes them relative links in Markdown. Prefix these with https:// (or switch to the corresponding learn.microsoft.com built-in roles pages) so the links work.

- built-in
  role: ["Key Vault Reader"](github.com/MicrosoftDocs/azure-docs/blob/main/articles/role-based-access-control/built-in-roles/security.md#key-vault-reader)
- lowest level scope - a resource group

rbac.md:150

• This Markdown link is missing the https:// scheme (github.com/...), so it will render as a relative link. Prefix with https:// (or use a learn.microsoft.com URL) so it works.

- built-in
  role: ["Key Vault Certificates Officer"](github.com/MicrosoftDocs/azure-docs/blob/main/articles/role-based-access-control/built-in-roles/security.md#key-vault-certificates-officer)
- lowest level scope - an individual keyvault

rbac.md:205

• Several links in this section are missing the https:// scheme (both github.com/... and learn.microsoft.com/...), which will make them relative and break navigation. Prefix these URLs with https:// so they resolve correctly.

- minimally sufficient built-in roles (all are required):
    - ["Key Vault Certificates Officer"](github.com/MicrosoftDocs/azure-docs/blob/main/articles/role-based-access-control/built-in-roles/security.md#key-vault-certificates-officer)
    - ["Key Vault Contributor"](learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-contributor)
    - ["Key Vault Access Administrator"](learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/)

scripts/store_types/bash/curl_create_store_types.sh:84

• The CertificateTags description shows a JSON example using single quotes ({'tag-name': 'tag-content'}), which is not valid JSON. Update the description string to show a valid example with double quotes to avoid confusing users.

      "Name": "CertificateTags",
      "DisplayName": "Certificate Tags",
      "Description": "If desired, tags can be applied to the KeyVault entries.  Provide them as a JSON string of key-value pairs ie: '{'tag-name': 'tag-content', 'other-tag-name': 'other-tag-content'}'",
      "Type": "string",

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.