Azure · rohitsinghal4u · Jun 4, 2026 · May 18, 2026 · May 18, 2026 · May 18, 2026
@@ -1,14 +1,11 @@
 # Release History
 
-## 4.11.2 (Unreleased)
+## 4.12.0b1 (2026-06-04)
 
 ### Features Added
 
-### Breaking Changes
-
-### Bugs Fixed
-
-### Other Changes
+- Added an experimental `PlatformManaged` property on `CertificatePolicy` for Azure Key Vault internal usage. Any calls using this property will fail and it is not recommended to be used at this point.
+- The default service version is now `2026-03-01-preview`
 
 ## 4.11.1 (2026-04-29)
 

@@ -1,10 +1,10 @@
 {
-  "apiVersion": "2025-07-01",
+  "apiVersion": "2026-03-01-preview",
   "apiVersions": {
-    "KeyVault": "2025-07-01"
+    "KeyVault": "2026-03-01-preview"
   },
-  "commit": "80cf521033f9499c3c86305d11c7de6451e796e5",
+  "commit": "44729a46b902922d8f50a383573f9c6641ce8e74",
   "repository_url": "https://github.com/Azure/azure-rest-api-specs",
   "typespec_src": "specification/keyvault/data-plane/Certificates",
-  "emitterVersion": "0.61.2"
+  "emitterVersion": "0.62.1"
 }
@@ -31,6 +31,7 @@
         "azure.keyvault.certificates._generated.models.KeyVaultErrorError": "KeyVaultError.error.anonymous",
         "azure.keyvault.certificates._generated.models.LifetimeAction": "KeyVault.LifetimeAction",
         "azure.keyvault.certificates._generated.models.OrganizationDetails": "KeyVault.OrganizationDetails",
+        "azure.keyvault.certificates._generated.models.PlatformManaged": "KeyVault.PlatformManaged",
         "azure.keyvault.certificates._generated.models.SecretProperties": "KeyVault.SecretProperties",
         "azure.keyvault.certificates._generated.models.SubjectAlternativeNames": "KeyVault.SubjectAlternativeNames",
         "azure.keyvault.certificates._generated.models.Trigger": "KeyVault.Trigger",
@@ -94,5 +95,6 @@
         "azure.keyvault.certificates._generated.aio.KeyVaultClient.purge_deleted_certificate": "KeyVault.purgeDeletedCertificate",
         "azure.keyvault.certificates._generated.KeyVaultClient.recover_deleted_certificate": "KeyVault.recoverDeletedCertificate",
         "azure.keyvault.certificates._generated.aio.KeyVaultClient.recover_deleted_certificate": "KeyVault.recoverDeletedCertificate"
-    }
+    },
+    "CrossLanguageVersion": "62e5a7e522bd"
 }
@@ -2,5 +2,5 @@
   "AssetsRepo": "Azure/azure-sdk-assets",
   "AssetsRepoPrefixPath": "python",
   "TagPrefix": "python/keyvault/azure-keyvault-certificates",
-  "Tag": "python/keyvault/azure-keyvault-certificates_a5c5c34814"
+  "Tag": "python/keyvault/azure-keyvault-certificates_e9794f1e9b"
 }
@@ -25,6 +25,7 @@
     KeyVaultCertificate,
     KeyVaultCertificateIdentifier
 )
+from ._generated.models import PlatformManaged
 from ._shared.client_base import ApiVersion
 
 __all__ = [
@@ -47,6 +48,7 @@
     "KeyUsageType",
     "LifetimeAction",
     "CertificateContentType",
+    "PlatformManaged",
     "WellKnownIssuerNames",
     "CertificateIssuer",
     "IssuerProperties"

@@ -107,6 +107,7 @@ def begin_create_certificate(
             or policy.san_ip_addresses
             or policy.san_uris
             or policy.subject
+            or policy.platform_managed
         ):
             raise ValueError(NO_SAN_OR_SUBJECT)
 

@@ -7,8 +7,8 @@
 # --------------------------------------------------------------------------
 
 from copy import deepcopy
+import sys
 from typing import Any, TYPE_CHECKING
-from typing_extensions import Self
 
 from azure.core import PipelineClient
 from azure.core.pipeline import policies
@@ -18,6 +18,11 @@
 from ._operations import _KeyVaultClientOperationsMixin
 from ._utils.serialization import Deserializer, Serializer
 
+if sys.version_info >= (3, 11):
+    from typing import Self
+else:
+    from typing_extensions import Self  # type: ignore
+
 if TYPE_CHECKING:
     from azure.core.credentials import TokenCredential
 
@@ -30,9 +35,10 @@ class KeyVaultClient(_KeyVaultClientOperationsMixin):
     :type vault_base_url: str
     :param credential: Credential used to authenticate requests to the service. Required.
     :type credential: ~azure.core.credentials.TokenCredential
-    :keyword api_version: The API version to use for this operation. Known values are "2025-07-01".
-     Default value is "2025-07-01". Note that overriding this default value may result in
-     unsupported behavior.
+    :keyword api_version: The API version to use for this operation. Known values are
+     "2026-03-01-preview" and None. Default value is None. If not set, the operation's default API
+     version will be used. Note that overriding this default value may result in unsupported
+     behavior.
     :paramtype api_version: str
     """
 

@@ -26,14 +26,15 @@ class KeyVaultClientConfiguration:  # pylint: disable=too-many-instance-attribut
     :type vault_base_url: str
     :param credential: Credential used to authenticate requests to the service. Required.
     :type credential: ~azure.core.credentials.TokenCredential
-    :keyword api_version: The API version to use for this operation. Known values are "2025-07-01".
-     Default value is "2025-07-01". Note that overriding this default value may result in
-     unsupported behavior.
+    :keyword api_version: The API version to use for this operation. Known values are
+     "2026-03-01-preview" and None. Default value is None. If not set, the operation's default API
+     version will be used. Note that overriding this default value may result in unsupported
+     behavior.
     :paramtype api_version: str
     """
 
     def __init__(self, vault_base_url: str, credential: "TokenCredential", **kwargs: Any) -> None:
-        api_version: str = kwargs.pop("api_version", "2025-07-01")
+        api_version: str = kwargs.pop("api_version", "2026-03-01-preview")
 
         if vault_base_url is None:
             raise ValueError("Parameter 'vault_base_url' must not be None.")