Error when trying to update the Ceritificate Issuer policies of a certificate

Question

Error when trying to update the Ceritificate Issuer policies of a certificate

Brahim Ait Ouakrim 0 Microsoft Employee

Hello,

I am facing an issue when trying to update the Certificate Issuer policies of a certificate

For SFI compliance, I wanted to udpate the certificate issuer policies from 6 months duration and renewal at 50%, to 12 months duration and a renewal at 24%. I didn't face any error when update the policy in the portal. But after some time the policy is back to original 6 months duration and renewal at 50%.

I have activated diagnostics on Azure Key Vault resource. I can see my requests to update the certificate issuer policies to 12 month/24% but I can't see in the logs any trace of the request updating back the policy to 6 months/50%.

Can you please help me understand what I have missed in the process?

Thanks

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-17T16:18:24.76+00:00
Hello Brahim Ait Ouakrim,

Could you provide a few additional details?

Is the certificate self-signed, imported, or issued through an integrated CA?

How are you verifying that the policy has reverted (Azure portal, Azure CLI, PowerShell, or REST API)?

Approximately how long after the update do you observe the values changing back?

Are there any Azure Policies, deployment pipelines, or automation processes associated with this Key Vault?

Since the update operation appears in the diagnostic logs, but there is no corresponding operation showing the policy being changed back, it would be helpful to understand how the current policy values are being validated and whether the behavior can be reproduced consistently.

If possible, please share the current certificate policy output from Azure CLI or PowerShell (with any sensitive information removed). That should help narrow down what is occurring.

Brahim Ait Ouakrim 0 Microsoft Employee

Thanks for the reply.

The certificate is issued through an integrated CA.

Azure portal is used to verify the policy

Approximately 24 hours after I update the policy it is changed back.

I am not aware of any azure policies, deployment pipelines... I added diagnostics to monitor who is updated back the policy but nothing in the log except my requests to update the certificate policy.

I have tried to update the policy twice and it got changed back twice. I guess it reproduces consistently.

Below is the policy output

SecretContentType               : application/x-pkcs12
Kty                             : RSA
KeySize                         : 2048
Curve                           : 
Exportable                      : True
ReuseKeyOnRenewal               : False
SubjectName                     : CN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
DnsNames                        : {}
Emails                          : 
UserPrincipalNames              : 
KeyUsage                        : {digitalSignature, keyEncipherment}
Ekus                            : {1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2}
ValidityInMonths                : 12
IssuerName                      : XXXXxxxx
CertificateType                 : 
RenewAtNumberOfDaysBeforeExpiry : 
RenewAtPercentageLifetime       : 24
EmailAtNumberOfDaysBeforeExpiry : 
EmailAtPercentageLifetime       : 
CertificateTransparency         : 
Enabled                         : True
Created                         : xx/xx/xxxx xx:xx:xx AM
Updated                         : 6/17/2026 xx:xx:xx AM

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-17T16:49:05.3633333+00:00
Hello Brahim Ait Ouakrim,

Thanks for the additional details.

Looking at the policy output you shared, the current policy stored in Key Vault shows:

ValidityInMonths = 12

RenewAtPercentageLifetime = 24

These are the values you updated the policy to.

Could you clarify where you are seeing the 6-month validity and 50% renewal settings? Based on the PowerShell output, the policy itself currently appears to be configured for 12 months and 24%.

If possible, please share:

A screenshot of the Azure portal page showing the 6-month / 50% values (with sensitive information removed)

The time when the screenshot was taken

A fresh PowerShell export collected at approximately the same time

This will help us determine whether there is a discrepancy between what the portal is displaying and the policy currently stored in Key Vault.
Brahim Ait Ouakrim 0 Reputation points Microsoft Employee

2026-06-17T17:55:00.2333333+00:00

Hello,

I have updated the issuer policy this morning to 12 months/24% (this is why it is now 12 months/24%), tomorrow if the error is consistent (as it has been for the last 2 days) it will be back to 6 months/50%

here is today current screenshot : The powershell output is the same as above
Brahim Ait Ouakrim 0 Reputation points Microsoft Employee

2026-06-18T09:01:39.23+00:00

Hello,

I have updated the issuer policy this morning to 12 months/24% (this is why it is now 12 months/24%), tomorrow if the error is consistent (as it has been for the last 2 days) it will be back to 6 months/50%

here is today current screenshot : The powershell output is the same as above
Sina Salam 31,456 Reputation points Volunteer Moderator

2026-06-23T15:01:12.0066667+00:00
Hello Brahim Ait Ouakrim,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having error when trying to update the Certificate Issuer policies of a certificate.

The issue is not with the CA issuer object itself; with all evidence it is a certificate issuance policy / lifecycle action drift problem. Azure Key Vault supports updating certificate validity and renewal lifecycle settings, but the value must be validated from the certificate policy object, not only from the Azure portal. The update should be applied using PowerShell or REST, then confirmed through Key Vault audit logs to identify whether another identity, automation, pipeline, managed identity, or service principal is reapplying the old 6 months / 50% policy. - https://learn.microsoft.com/en-us/powershell/module/az.keyvault/set-azkeyvaultcertificatepolicy?view=azps-16.0.0, https://learn.microsoft.com/en-us/rest/api/keyvault/certificates/update-certificate-policy/update-certificate-policy?view=rest-keyvault-certificates-2025-07-01

What you can do is to:

Confirm whether the requirement is renew at 24% of certificate lifetime or renew 24 days before expiry, because these are different Key Vault lifecycle settings.

Update the certificate policy using Set-AzKeyVaultCertificatePolicy or the Key Vault certificate policy REST API, not only the Azure portal.

Verify the effective policy using PowerShell or REST immediately after the update.

Query Key Vault audit logs for Identity, ClientInfo, CallerIpAddress, CertificatePolicyProperties, and CorrelationId to find the actor that changes the policy back.

If no second update is logged and PowerShell still shows the correct value, treat the portal value as a display/cache inconsistency. If PowerShell also shows the reverted value without an audit record, raise an Azure support case with the correlation IDs and timestamps.

After applying the certificate policy through PowerShell or REST and reviewing Key Vault audit logs, the root cause will be reduced to one of three confirmed outcomes: an external process is reverting the policy, the Azure portal is displaying stale or incorrect values, or a service-side investigation is required because the policy changed without an auditable update operation.

Use the below official resource links for more reading and implementation steps:

Configure certificate autorotation in Azure Key Vault

Renew your Azure Key Vault certificates

Set-AzKeyVaultCertificatePolicy PowerShell reference

https://learn.microsoft.com/en-us/rest/api/keyvault/certificates/update-certificate-policy/update-certificate-policy

Azure Key Vault logging

AZKVAuditLogs reference

I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-26T06:43:35.17+00:00

Hello Brahim Ait Ouakrim,

Any update on this? Please confirm if you still have further queries.
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator

2026-06-26T08:51:37.5966667+00:00
hi Brahim Ait Ouakrim & thx for sharing urs issue here at Q&A portal,

looks like something outside ur manual portal change is reapplying the old Key Vault certificate policy. If the policy changes to 12 months / 24%, then later goes back to 6 months / 50%, but Key Vault diagnostics only show ur update and not the rollback, I’d check IaC/automation first. Terraform, Bicep/ARM, Azure Policy remediation, Defender/SFI automation, or a deployment pipeline can reset the cert policy without it being obvious from the cert blade. Check the Activity Log at the Key Vault and resource group level around the time it flips back. Key Vault diagnostic logs show data-plane calls, but ARM deployments/policy remediations may show up better in Activity Log.

az monitor activity-log list \

--resource-id '<key-vault-resource-id>' \

--offset 7d

and check deployments

az deployment group list -g <rg> -o table

if the cert is managed by an integrated issuer/CA, renewal policy values may be constrained or normalized by the issuer policy/template. So the portal accepts the update, but later sync/renewal logic may restore the CA-backed policy.

My bet either an IaC drift correction job or issuer-side policy/template sync is putting it back. Key Vault usually doesn’t randomly revert cert policies by itself. Check Activity Log, Azure Policy compliance/remediation history, pipelines, and whoever manages the cert definition as code.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/
Moosa Khan 695 Reputation points Microsoft External Staff Moderator

2026-07-16T20:14:52.69+00:00

Hello Brahim Ait Ouakrim,

Following up to see if the information provided was helpful please let me know if you have questions.
Moosa Khan 695 Reputation points Microsoft External Staff Moderator

2026-07-21T00:19:29.6+00:00

Hello Brahim Ait Ouakrim,

Following up to see if the information provided was helpful please let me know if you have questions.

2 answers

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-17T16:18:24.76+00:00

Hello Brahim Ait Ouakrim,

Could you provide a few additional details?

Is the certificate self-signed, imported, or issued through an integrated CA?

How are you verifying that the policy has reverted (Azure portal, Azure CLI, PowerShell, or REST API)?

Approximately how long after the update do you observe the values changing back?

Are there any Azure Policies, deployment pipelines, or automation processes associated with this Key Vault?

Since the update operation appears in the diagnostic logs, but there is no corresponding operation showing the policy being changed back, it would be helpful to understand how the current policy values are being validated and whether the behavior can be reproduced consistently.

If possible, please share the current certificate policy output from Azure CLI or PowerShell (with any sensitive information removed). That should help narrow down what is occurring.
Brahim Ait Ouakrim 0 Reputation points Microsoft Employee

2026-06-17T16:34:50.4366667+00:00

Thanks for the reply.

The certificate is issued through an integrated CA.

Azure portal is used to verify the policy

Approximately 24 hours after I update the policy it is changed back.

I am not aware of any azure policies, deployment pipelines... I added diagnostics to monitor who is updated back the policy but nothing in the log except my requests to update the certificate policy.

I have tried to update the policy twice and it got changed back twice. I guess it reproduces consistently.

Below is the policy output

SecretContentType : application/x-pkcs12 Kty : RSA KeySize : 2048 Curve : Exportable : True ReuseKeyOnRenewal : False SubjectName : CN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx DnsNames : {} Emails : UserPrincipalNames : KeyUsage : {digitalSignature, keyEncipherment} Ekus : {1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2} ValidityInMonths : 12 IssuerName : XXXXxxxx CertificateType : RenewAtNumberOfDaysBeforeExpiry : RenewAtPercentageLifetime : 24 EmailAtNumberOfDaysBeforeExpiry : EmailAtPercentageLifetime : CertificateTransparency : Enabled : True Created : xx/xx/xxxx xx:xx:xx AM Updated : 6/17/2026 xx:xx:xx AM
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-17T16:49:05.3633333+00:00

Hello Brahim Ait Ouakrim,

Thanks for the additional details.

Looking at the policy output you shared, the current policy stored in Key Vault shows:

ValidityInMonths = 12

RenewAtPercentageLifetime = 24

These are the values you updated the policy to.

Could you clarify where you are seeing the 6-month validity and 50% renewal settings? Based on the PowerShell output, the policy itself currently appears to be configured for 12 months and 24%.

If possible, please share:

A screenshot of the Azure portal page showing the 6-month / 50% values (with sensitive information removed)

The time when the screenshot was taken

A fresh PowerShell export collected at approximately the same time

This will help us determine whether there is a discrepancy between what the portal is displaying and the policy currently stored in Key Vault.
Brahim Ait Ouakrim 0 Reputation points Microsoft Employee

2026-06-17T17:55:00.2333333+00:00

Hello,

I have updated the issuer policy this morning to 12 months/24% (this is why it is now 12 months/24%), tomorrow if the error is consistent (as it has been for the last 2 days) it will be back to 6 months/50%

here is today current screenshot : The powershell output is the same as above
Brahim Ait Ouakrim 0 Reputation points Microsoft Employee

2026-06-18T09:01:39.23+00:00

Hello,

I have updated the issuer policy this morning to 12 months/24% (this is why it is now 12 months/24%), tomorrow if the error is consistent (as it has been for the last 2 days) it will be back to 6 months/50%

here is today current screenshot : The powershell output is the same as above
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-26T06:43:35.17+00:00

Hello Brahim Ait Ouakrim,

Any update on this? Please confirm if you still have further queries.
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator

2026-06-26T08:51:37.5966667+00:00

hi Brahim Ait Ouakrim & thx for sharing urs issue here at Q&A portal,

looks like something outside ur manual portal change is reapplying the old Key Vault certificate policy. If the policy changes to 12 months / 24%, then later goes back to 6 months / 50%, but Key Vault diagnostics only show ur update and not the rollback, I’d check IaC/automation first. Terraform, Bicep/ARM, Azure Policy remediation, Defender/SFI automation, or a deployment pipeline can reset the cert policy without it being obvious from the cert blade. Check the Activity Log at the Key Vault and resource group level around the time it flips back. Key Vault diagnostic logs show data-plane calls, but ARM deployments/policy remediations may show up better in Activity Log.

az monitor activity-log list \

--resource-id '<key-vault-resource-id>' \

--offset 7d

and check deployments

az deployment group list -g <rg> -o table

if the cert is managed by an integrated issuer/CA, renewal policy values may be constrained or normalized by the issuer policy/template. So the portal accepts the update, but later sync/renewal logic may restore the CA-backed policy.

My bet either an IaC drift correction job or issuer-side policy/template sync is putting it back. Key Vault usually doesn’t randomly revert cert policies by itself. Check Activity Log, Azure Policy compliance/remediation history, pipelines, and whoever manages the cert definition as code.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/
Moosa Khan 695 Reputation points Microsoft External Staff Moderator

2026-07-16T20:14:52.69+00:00

Hello Brahim Ait Ouakrim,

Following up to see if the information provided was helpful please let me know if you have questions.
Moosa Khan 695 Reputation points Microsoft External Staff Moderator

2026-07-21T00:19:29.6+00:00

Hello Brahim Ait Ouakrim,

Following up to see if the information provided was helpful please let me know if you have questions.

Answer 1

Hello Brahim Ait Ouakrim,

Based on the information you've provided, the current evidence does not yet confirm that the certificate policy is actually being reverted.

The PowerShell output you shared shows:

ValidityInMonths = 12
RenewAtPercentageLifetime = 24

which are the values you updated the policy to. [Azure - Mi...rosoft Q&A | Learn.Microsoft.com]

Before concluding that another process is resetting the policy, I would recommend validating the effective policy at the exact time you observe the portal showing the original 6 months / 50% values.

Could you please capture the following when the issue occurs again?

A screenshot of the Azure portal showing the 6 months / 50% settings.
A fresh PowerShell or CLI export of the certificate policy taken at approximately the same time.
The approximate timestamp when the policy appears to revert.

If the portal shows 6 months / 50% but PowerShell still returns 12 months / 24%, that would indicate a discrepancy between the portal display and the stored policy.

If both the portal and PowerShell show 6 months / 50%, then we can investigate whether another process (automation, deployment pipeline, Azure Policy remediation, or issuer-side policy synchronization) is updating the policy.

Since the certificate is issued through an integrated CA, it would also be useful to understand whether the issuer template enforces specific validity or renewal settings. [Azure - Mi...rosoft Q&A | Learn.Microsoft.com]

Please share the updated portal screenshot and PowerShell output when the behavior reoccurs, and we'll continue the investigation from there.

Thanks, Moosa Khan

Answer 2

Your PowerShell output confirms that Key Vault stored 12 months / 24% immediately after the save; it does not yet prove that the policy later reverted.

When the portal next shows 6 months / 50%, immediately run:


Get-AzKeyVaultCertificatePolicy -VaultName <vault> -Name <certificate> |

  Select-Object ValidityInMonths, RenewAtPercentageLifetime, Updated

If this still returns 12 / 24, the portal view is stale—the policy itself did not change. If it returns 6 / 50, search the Key Vault audit logs around that timestamp for the certificate-policy update and inspect the identity, client information, caller IP, and correlation ID. Allow up to about ten minutes for audit records to arrive. Also check deployment pipelines, IaC, policy remediation, and the integrated CA template, which may enforce its own issuance settings.

One important detail: RenewAtPercentageLifetime = 24 means renew after 24% of the lifetime has elapsed, not when 24% remains. If no update is audited but the API value truly changes, open a support case with both policy captures and exact timestamps.