KeyVault Schema Requires Access Policy - Docs Say It Is Not Required

In the Microsoft.KeyVault/vaults docs, it says that accessPolicies is not required:

When I deploy with this resource, I get no errors

{
    "type": "Microsoft.KeyVault/vaults",
    "name": "[variables('keyVaultName')]",
    "apiVersion": "2018-02-14",
    "location": "[resourceGroup().location]",
    "tags": {},
    "scale": null,
    "properties": {
        "sku": "[parameters('keyVaultSku')]",
        "tenantId": "[parameters('tenantId')]",
        "accessPolicies": [],
        "enabledForDeployment": false,
        "enabledForDiskEncryption": false,
        "enabledForTemplateDeployment": false
    },
    "dependsOn": []
}

When I deploy with this resource (accessPolicies missing)

{
    "type": "Microsoft.KeyVault/vaults",
    "name": "[variables('keyVaultName')]",
    "apiVersion": "2018-02-14",
    "location": "[resourceGroup().location]",
    "tags": {},
    "scale": null,
    "properties": {
        "sku": "[parameters('keyVaultSku')]",
        "tenantId": "[parameters('tenantId')]",
        "enabledForDeployment": false,
        "enabledForDiskEncryption": false,
        "enabledForTemplateDeployment": false
    },
    "dependsOn": []
}

I get this error:

[winperec]

Very weird behavior, it makes ARM templates for KeyVault almost useless without external scripts…

[mslot]

So on the one side we have the “Use ARM to automatically deploy all things”, and on the other side we have “be secure, use keyvault, no extra code needed”, but we cant use both.

I need to have managed identites added dynamically. I want to be able to redeploy my keyvault and not having access policies wiped.

I am leaving a comment here, so I get updates! Please tell me when this is fixed, or if it will be fixed. I see this as a bug, and not a feature.