New-PSUSecretVault

Create a model-backed Azure Key Vault registration for use with PowerShell Universal secret variables and credentials.

SYNOPSIS

Creates a secret vault registration.

SYNTAX

New-PSUSecretVault -Name <String> -VaultUri <String> [-Type <String>] [-Description <String>] [-AuthenticationType <VaultAuthenticationType>] [-TenantId <String>] [-ClientId <String>] [-ClientSecretVariable <String>] [-ManagedIdentityClientId <String>] [<ConnectionOptions>] [<CommonParameters>]

<ConnectionOptions>: [-ComputerName <String>] [-AppToken <String>] [-Credential <PSCredential>] [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies].

DESCRIPTION

Creates a model-backed PowerShell Universal secret vault registration. The provider type defaults to AzureKeyVault; Azure Key Vault registrations are handled in-process and can be selected for secret variables and credentials. For client-secret authentication, -ClientSecretVariable names a PSU secret variable holding the Entra ID client secret; the value is not written to the vault configuration.

EXAMPLES

New-PSUSecretVault -Name 'Production Key Vault' `
    -VaultUri 'https://prod.vault.azure.net/' `
    -AuthenticationType ManagedIdentity

New-PSUSecretVault -Name 'Customer Key Vault' `
    -VaultUri 'https://customer.vault.azure.net/' `
    -AuthenticationType ClientSecret `
    -TenantId '00000000-0000-0000-0000-000000000000' `
    -ClientId '11111111-1111-1111-1111-111111111111' `
    -ClientSecretVariable 'AzureKeyVaultClientSecret'

PARAMETERS

Parameter	Description
-Name	Required vault registration name.
-VaultUri	Required Azure Key Vault URI.
-Type	Vault provider type, default AzureKeyVault.
-Description	Description of the registration.
-AuthenticationType	Authentication mode: Default, ManagedIdentity, or ClientSecret.
-TenantId	Entra ID tenant ID for client-secret authentication.
-ClientId	Entra ID application client ID for client-secret authentication.
-ClientSecretVariable	Name of PSU variable holding the application client secret.
-ManagedIdentityClientId	User-assigned managed identity client ID; omit for a system-assigned identity.
-ComputerName	PSU Management API URL or host name (alias -Uri).
-AppToken	Management API app token.
-Credential	Management API credentials.
-UseDefaultCredentials	Uses current Windows credentials.
-Integrated	Uses the in-process management client.
-TrustCertificate	Ignores certificate validation errors.
-Cookies	Reuses session authentication cookies.

OUTPUTS

PowerShellUniversal.Vault.

RELATED LINKS

Get-PSUSecretVault · Set-PSUSecretVault

PERMISSIONS

The access token requires platform.vaults/create to run this cmdlet remotely.