🧩 Overview

You’ll:

1. List secrets from the source Key Vault
2. Loop through each secret name
3. Retrieve the latest value
4. Write it into the destination Key Vault

This approach preserves names and values, but not version history (you almost never want to duplicate every historical version).

⚙️ Prerequisites

Make sure:

az login
az account set --subscription "<YourSubscriptionID>"

You’ll also need read access to the source Key Vault and set access to the destination Key Vault (via RBAC or access policy).

🧠 Script (Bash for Azure Cloud Shell)

# Replace with your vault names
SOURCE_VAULT="source-keyvault-name"
DEST_VAULT="destination-keyvault-name"

# Get all secret names (not versions)
for secret in $(az keyvault secret list --vault-name $SOURCE_VAULT --query "[].name" -o tsv)
do
  echo "Copying secret: $secret"
  
  # Get the latest secret value
  value=$(az keyvault secret show --vault-name $SOURCE_VAULT --name $secret --query "value" -o tsv)

  # Recreate the secret in the destination vault
  az keyvault secret set --vault-name $DEST_VAULT --name $secret --value "$value" >/dev/null
  
done

echo "✅ All secrets copied from $SOURCE_VAULT to $DEST_VAULT"

🧰 Notes

• If you have disabled secrets in the source vault and want to skip them:

  az keyvault secret list --vault-name $SOURCE_VAULT --query "[?attributes.enabled==\`true\`].name" -o tsv

• To handle secrets with special characters or newlines safely, consider using --query "value" -o json and proper quoting, e.g.:

  value=$(az keyvault secret show --vault-name $SOURCE_VAULT --name $secret --query "value" -o json | jq -r)

• The script does not copy tags or contentType. To include those, you’d extend it:

  metadata=$(az keyvault secret show --vault-name $SOURCE_VAULT --name $secret)
  value=$(echo $metadata | jq -r '.value')
  contentType=$(echo $metadata | jq -r '.contentType')
  az keyvault secret set --vault-name $DEST_VAULT --name $secret --value "$value" --content-type "$contentType"

🔐 Alternative (PowerShell in Cloud Shell)

If you prefer PowerShell syntax:

$sourceVault = "source-keyvault-name"
$destVault   = "destination-keyvault-name"

$secrets = az keyvault secret list --vault-name $sourceVault | ConvertFrom-Json
foreach ($secret in $secrets) {
    $name = $secret.name
    $value = az keyvault secret show --vault-name $sourceVault --name $name --query value -o tsv
    az keyvault secret set --vault-name $destVault --name $name --value $value | Out-Null
    Write-Host "Copied secret: $name"
}

Would you like me to include copying certificates and keys as well (not just secrets)? It’s a slightly different process involving az keyvault certificate and az keyvault key commands.