🐞 The 'Get-AzKeyVaultAccessPolicies' module could not be loaded.

[JoLanckriet]

Hi,

Since a month ago retrieving keyvault access policies with arcus does not work anymore.

Using this step in the pipeline:

- task: AzurePowerShell@5
  displayName: 'Retrieve KeyVault Access Policies'
  inputs:
    azureSubscription: ${{parameters.azureSubscription}}
    scriptType: 'InlineScript'
    azurePowerShellVersion: 'LatestVersion'
    Inline: |
        Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
        Install-Module -Name Arcus.Scripting.KeyVault -Repository PSGallery -AllowClobber
        $accessPolicies = Get-AzKeyVaultAccessPolicies -KeyVaultName $(InstallerApp.KeyVault.Name) -ResourceGroupName $(InstallerApp.ResourceGroup.Name)
        $accessPoliciesjson = $accessPolicies | ConvertTo-Json -Depth 5 -Compress
        Write-Host ("##vso[task.setvariable variable=InstallerApp.KeyVault.AccessPolicies;]$accessPoliciesjson")

This used to work like expected and the policies where retrieved however the following error started appearing since the middle of december 2024 (to my knowledge).

##[error]The 'Get-AzKeyVaultAccessPolicies' command was found in the module 'Arcus.Scripting.KeyVault', but the module could not be loaded. For more information, run 'Import-Module Arcus.Scripting.KeyVault'.
##[error]PowerShell exited with code '1'.

I was able to resolve this by installing the Az.Accounts module seperately in the pipeline before executing the step mentioned above. This results in the following steps:

- task: AzurePowerShell@5
  displayName: 'Install Az.Accounts'
  inputs:
    azureSubscription: ${{parameters.azureSubscription}}
    scriptType: 'InlineScript'
    azurePowerShellVersion: 'LatestVersion'
    Inline: |    
        Get-InstalledModule -Name Az.Accounts -AllVersions -ErrorAction SilentlyContinue | Uninstall-Module -Force -ErrorAction SilentlyContinue
        Install-Module -Name Az.Accounts -Force -AllowClobber

- task: AzurePowerShell@5
  displayName: 'Retrieve KeyVault Access Policies'
  inputs:
    azureSubscription: ${{parameters.azureSubscription}}
    scriptType: 'InlineScript'
    azurePowerShellVersion: 'LatestVersion'
    Inline: |
        Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
        Install-Module -Name Arcus.Scripting.KeyVault -Repository PSGallery -AllowClobber
        $accessPolicies = Get-AzKeyVaultAccessPolicies -KeyVaultName $(InstallerApp.KeyVault.Name) -ResourceGroupName $(InstallerApp.ResourceGroup.Name)
        $accessPoliciesjson = $accessPolicies | ConvertTo-Json -Depth 5 -Compress
        Write-Host ("##vso[task.setvariable variable=InstallerApp.KeyVault.AccessPolicies;]$accessPoliciesjson")

Doing this returns the expected behaviour.

[stijnmoreels]

Thx for letting us know!

@pim-simons , did we released yet the global Azure packages update for Scripting? I would guess this is related to older package versions?

[pim-simons]

Thx for letting us know!

@pim-simons , did we released yet the global Azure packages update for Scripting? I would guess this is related to older package versions?

Yeah this seems related to the package version updates, it appears the devops agents do not have the latest version of Az.Accounts installed.
I don't think there is a "fix" for this, but we can mention this in the docs probably.

[pim-simons]

Just ran the following on a Azure Devops pipeline:

Install-Module -Name Arcus.Scripting.KeyVault -AllowClobber -Force -Scope CurrentUser

Get-InstalledModule 

This now returns:

And running Get-AzKeyVaultAccessPolicies without updating Az.Accounts now works fine for me as well.
From my point of view we can close this, but if the problem still occurs for you feel free to open the issue again and we can look further into it.