[Key Vault] Added API 2026-07-01-preview with EKM Private Endpoint support

sdk/keyvault/azure-keyvault-administration/CHANGELOG.md

@@ -4,6 +4,19 @@
 
 ### Features Added
 
+- Added support for service API version `2026-07-01-preview`
+- Added EKM proxy private endpoint management to `KeyVaultEkmClient`. The client now exposes
+  `begin_create_ekm_private_endpoint`, `begin_delete_ekm_private_endpoint`, `get_ekm_private_endpoint`,
+  `list_ekm_private_endpoints`, and `get_ekm_private_endpoint_operation_status`.
+- Added `KeyVaultEkmPrivateEndpoint`, `KeyVaultEkmPrivateEndpointConnectionState`,
+  `KeyVaultEkmPrivateEndpointProperties`, and `KeyVaultEkmPrivateEndpointOperation` models, along with the
+  `KeyVaultEkmConnectivityMode`, `KeyVaultEkmPrivateEndpointConnectionStatus`,
+  `KeyVaultEkmPrivateEndpointOperationStatus`, `KeyVaultEkmPrivateEndpointOperationType`, and
+  `KeyVaultEkmPrivateEndpointProvisioningState` enums.
+- Added a `connectivity_mode` keyword argument and attribute to `KeyVaultEkmConnection`. Set this to
+  `KeyVaultEkmConnectivityMode.PRIVATE_ENDPOINT` to reach the EKM proxy through an EKM proxy private endpoint, in which
+  case `host` is the name of the private endpoint instead of a DNS name or IP address.
+
 ### Breaking Changes
 
 ### Bugs Fixed
@@ -12,6 +25,8 @@
 
 ### Other Changes
 
+- Key Vault API version `2026-07-01-preview` is now the default.
+
 ## 4.8.0b2 (2026-07-08)
 
 ### Bugs Fixed

sdk/keyvault/azure-keyvault-administration/README.md

@@ -161,12 +161,20 @@ A `KeyVaultSettingsClient` manages Managed HSM account settings.
 
 ### KeyVaultEkmClient
 
-A `KeyVaultEkmClient` manages the Managed HSM's External Key Manager (EKM) connection.
+A `KeyVaultEkmClient` manages the Managed HSM's External Key Manager (EKM) connection and its EKM proxy private
+endpoints.
 
 ### EKM Connection
 
 An EKM connection represents the connection of an Azure Managed HSM resource with an external HSM.
 
+### EKM Proxy Private Endpoint
+
+An EKM proxy private endpoint lets a Managed HSM reach an EKM proxy through an Azure Private Link Service instead of
+the public internet. A Managed HSM may have up to two EKM proxy private endpoints. To route an EKM connection through
+one, set the connection's `host` to the private endpoint's name and its `connectivity_mode` to
+`KeyVaultEkmConnectivityMode.PRIVATE_ENDPOINT`.
+
 ## Examples
 This section contains code snippets covering common tasks:
 * Access control
@@ -440,6 +448,7 @@ Several samples are available in the Azure SDK for Python GitHub repository. The
 - [Full backup and restore][backup_operations_sample] ([async version][backup_operations_async_sample])
 - [List and update Key Vault settings][settings_operations_sample] ([async version][settings_operations_async_sample])
 - [Retrieve and manage EKM connections][ekm_operations_sample] ([async version][ekm_operations_async_sample])
+- [Manage EKM proxy private endpoints][ekm_private_endpoint_operations_sample] ([async version][ekm_private_endpoint_operations_async_sample])
 
 ###  Additional documentation
 For more extensive documentation on Azure Key Vault, see the [API reference documentation][reference_docs].
@@ -503,6 +512,8 @@ contact opencode@microsoft.com with any additional questions or comments.
 [settings_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/settings_operations_async.py
 [ekm_operations_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/ekm_operations.py
 [ekm_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/ekm_operations_async.py
+[ekm_private_endpoint_operations_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/ekm_private_endpoint_operations.py
+[ekm_private_endpoint_operations_async_sample]: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvault/azure-keyvault-administration/samples/ekm_private_endpoint_operations_async.py
 [storage_blob]: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/storage/azure-storage-blob/README.md
 [storage_explorer]: https://learn.microsoft.com/azure/vs-azure-tools-storage-manage-with-storage-explorer
 

sdk/keyvault/azure-keyvault-administration/_metadata.json

@@ -1,6 +1,6 @@
 {
-  "apiVersion": "2026-01-01-preview",
+  "apiVersion": "2026-07-01-preview",
   "apiVersions": {
-    "KeyVault": "2026-01-01-preview"
+    "KeyVault": "2026-07-01-preview"
   }
 }

sdk/keyvault/azure-keyvault-administration/api.md

@@ -4,6 +4,7 @@ namespace azure.keyvault.administration
     class azure.keyvault.administration.ApiVersion(str, Enum, metaclass=CaseInsensitiveEnumMeta):
         V2025_07_01 = "2025-07-01"
         V2026_01_01_PREVIEW = "2026-01-01-preview"
+        V2026_07_01_PREVIEW = "2026-07-01-preview"
         V7_2 = "7.2"
         V7_3 = "7.3"
         V7_4 = "7.4"
@@ -269,6 +270,23 @@ namespace azure.keyvault.administration
                 **kwargs: Any
             ) -> None: ...
 
+        @distributed_trace
+        def begin_create_ekm_private_endpoint(
+                self, 
+                name: str, 
+                private_link_service_id: str, 
+                *, 
+                request_message: Optional[str] = ..., 
+                **kwargs: Any
+            ) -> LROPoller[KeyVaultEkmPrivateEndpointOperation]: ...
+
+        @distributed_trace
+        def begin_delete_ekm_private_endpoint(
+                self, 
+                name: str, 
+                **kwargs: Any
+            ) -> LROPoller[KeyVaultEkmPrivateEndpointOperation]: ...
+
         @distributed_trace
         def check_ekm_connection(self, **kwargs: Any) -> KeyVaultEkmProxyInfo: ...
 
@@ -290,6 +308,23 @@ namespace azure.keyvault.administration
         @distributed_trace
         def get_ekm_connection(self, **kwargs: Any) -> KeyVaultEkmConnection: ...
 
+        @distributed_trace
+        def get_ekm_private_endpoint(
+                self, 
+                name: str, 
+                **kwargs: Any
+            ) -> KeyVaultEkmPrivateEndpoint: ...
+
+        @distributed_trace
+        def get_ekm_private_endpoint_operation_status(
+                self, 
+                job_id: str, 
+                **kwargs: Any
+            ) -> KeyVaultEkmPrivateEndpointOperation: ...
+
+        @distributed_trace
+        def list_ekm_private_endpoints(self, **kwargs: Any) -> ItemPaged[KeyVaultEkmPrivateEndpoint]: ...
+
         @distributed_trace
         def send_request(
                 self, 
@@ -308,6 +343,7 @@ namespace azure.keyvault.administration
 
 
     class azure.keyvault.administration.KeyVaultEkmConnection:
+        connectivity_mode: Union[str, KeyVaultEkmConnectivityMode, None]
         host: str
         path_prefix: Union[str, None]
         server_ca_certificates: list[bytes]
@@ -318,13 +354,93 @@ namespace azure.keyvault.administration
                 host: str, 
                 server_ca_certificates: List[bytes], 
                 *, 
+                connectivity_mode: Optional[Union[str, KeyVaultEkmConnectivityMode]] = ..., 
                 path_prefix: Optional[str] = ..., 
                 server_subject_common_name: Optional[str] = ...
             ) -> None: ...
 
         def __repr__(self) -> str: ...
 
 
+    class azure.keyvault.administration.KeyVaultEkmConnectivityMode(str, Enum, metaclass=CaseInsensitiveEnumMeta):
+        PRIVATE_ENDPOINT = "PrivateEndpoint"
+        PUBLIC = "Public"
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpoint:
+        location: Union[str, None]
+        name: Union[str, None]
+        private_link_service_connection_state: Union[KeyVaultEkmPrivateEndpointConnectionState, None]
+        properties: Union[KeyVaultEkmPrivateEndpointProperties, None]
+        provisioning_state: Union[str, KeyVaultEkmPrivateEndpointProvisioningState, None]
+
+        def __init__(self, **kwargs: Any) -> None: ...
+
+        def __repr__(self) -> str: ...
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpointConnectionState:
+        actions_required: Union[str, None]
+        description: Union[str, None]
+        status: Union[str, KeyVaultEkmPrivateEndpointConnectionStatus, None]
+
+        def __init__(self, **kwargs: Any) -> None: ...
+
+        def __repr__(self) -> str: ...
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpointConnectionStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta):
+        APPROVED = "Approved"
+        DISCONNECTED = "Disconnected"
+        PENDING = "Pending"
+        REJECTED = "Rejected"
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpointOperation:
+        end_time: Union[datetime, None]
+        error_code: Union[str, None]
+        error_message: Union[str, None]
+        job_id: Union[str, None]
+        operation_type: Union[str, KeyVaultEkmPrivateEndpointOperationType, None]
+        private_endpoint_name: Union[str, None]
+        start_time: Union[datetime, None]
+        status: Union[str, KeyVaultEkmPrivateEndpointOperationStatus, None]
+        status_details: Union[str, None]
+
+        def __init__(self, **kwargs: Any) -> None: ...
+
+        def __repr__(self) -> str: ...
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpointOperationStatus(str, Enum, metaclass=CaseInsensitiveEnumMeta):
+        CANCELED = "Canceled"
+        FAILED = "Failed"
+        NOT_STARTED = "NotStarted"
+        RUNNING = "Running"
+        SUCCEEDED = "Succeeded"
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpointOperationType(str, Enum, metaclass=CaseInsensitiveEnumMeta):
+        CREATE = "Create"
+        DELETE = "Delete"
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpointProperties:
+        private_link_service_connection_name: Union[str, None]
+        private_link_service_id: Union[str, None]
+
+        def __init__(self, **kwargs: Any) -> None: ...
+
+        def __repr__(self) -> str: ...
+
+
+    class azure.keyvault.administration.KeyVaultEkmPrivateEndpointProvisioningState(str, Enum, metaclass=CaseInsensitiveEnumMeta):
+        DELETING = "Deleting"
+        FAILED = "Failed"
+        SUCCEEDED = "Succeeded"
+        UPDATING = "Updating"
+
+
     class azure.keyvault.administration.KeyVaultEkmProxyClientCertificateInfo:
         ca_certificates: Union[list[bytes], None]
         subject_common_name: Union[str, None]
@@ -675,6 +791,23 @@ namespace azure.keyvault.administration.aio
                 **kwargs: Any
             ) -> None: ...
 
+        @distributed_trace_async
+        async def begin_create_ekm_private_endpoint(
+                self, 
+                name: str, 
+                private_link_service_id: str, 
+                *, 
+                request_message: Optional[str] = ..., 
+                **kwargs: Any
+            ) -> AsyncLROPoller[KeyVaultEkmPrivateEndpointOperation]: ...
+
+        @distributed_trace_async
+        async def begin_delete_ekm_private_endpoint(
+                self, 
+                name: str, 
+                **kwargs: Any
+            ) -> AsyncLROPoller[KeyVaultEkmPrivateEndpointOperation]: ...
+
         @distributed_trace_async
         async def check_ekm_connection(self, **kwargs: Any) -> KeyVaultEkmProxyInfo: ...
 
@@ -696,6 +829,23 @@ namespace azure.keyvault.administration.aio
         @distributed_trace_async
         async def get_ekm_connection(self, **kwargs: Any) -> KeyVaultEkmConnection: ...
 
+        @distributed_trace_async
+        async def get_ekm_private_endpoint(
+                self, 
+                name: str, 
+                **kwargs: Any
+            ) -> KeyVaultEkmPrivateEndpoint: ...
+
+        @distributed_trace_async
+        async def get_ekm_private_endpoint_operation_status(
+                self, 
+                job_id: str, 
+                **kwargs: Any
+            ) -> KeyVaultEkmPrivateEndpointOperation: ...
+
+        @distributed_trace
+        def list_ekm_private_endpoints(self, **kwargs: Any) -> AsyncItemPaged[KeyVaultEkmPrivateEndpoint]: ...
+
         @distributed_trace_async
         def send_request(
                 self, 

sdk/keyvault/azure-keyvault-administration/api.metadata.yml

@@ -1,3 +1,3 @@
-apiMdSha256: 85dc8ab302f592b946a6721db3fdc071a569e0d74fa9aae664ceef960665a0ec
+apiMdSha256: a2d9996b6dbea7e5150105e13cd638d24ae423239c423a7bb69b247c061870a8
 parserVersion: 0.3.28
 pythonVersion: 3.13.14

sdk/keyvault/azure-keyvault-administration/apiview-properties.json

@@ -2,6 +2,12 @@
     "CrossLanguagePackageId": "KeyVault",
     "CrossLanguageDefinitionId": {
         "azure.keyvault.administration._generated.models.EkmConnection": "KeyVault.EkmConnection",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpoint": "KeyVault.EkmPrivateEndpoint",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointConnectionState": "KeyVault.EkmPrivateEndpointConnectionState",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointCreateParameters": "KeyVault.EkmPrivateEndpointCreateParameters",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointListResult": "KeyVault.EkmPrivateEndpointListResult",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointOperation": "KeyVault.EkmPrivateEndpointOperation",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointProperties": "KeyVault.EkmPrivateEndpointProperties",
         "azure.keyvault.administration._generated.models.EkmProxyClientCertificateInfo": "KeyVault.EkmProxyClientCertificateInfo",
         "azure.keyvault.administration._generated.models.EkmProxyInfo": "KeyVault.EkmProxyInfo",
         "azure.keyvault.administration._generated.models.FullBackupOperation": "KeyVault.FullBackupOperation",
@@ -31,6 +37,11 @@
         "azure.keyvault.administration._generated.models.RoleScope": "KeyVault.RoleScope",
         "azure.keyvault.administration._generated.models.OperationStatus": "KeyVault.OperationStatus",
         "azure.keyvault.administration._generated.models.SettingTypeEnum": "KeyVault.SettingTypeEnum",
+        "azure.keyvault.administration._generated.models.EkmConnectivityMode": "KeyVault.EkmConnectivityMode",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointOperationType": "KeyVault.EkmPrivateEndpointOperationType",
+        "azure.keyvault.administration._generated.models.OperationState": "Azure.Core.Foundations.OperationState",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointProvisioningState": "KeyVault.EkmPrivateEndpointProvisioningState",
+        "azure.keyvault.administration._generated.models.EkmPrivateEndpointConnectionStatus": "KeyVault.EkmPrivateEndpointConnectionStatus",
         "azure.keyvault.administration._generated.operations.RoleDefinitionsOperations.delete": "KeyVault.RoleDefinitions.delete",
         "azure.keyvault.administration._generated.aio.operations.RoleDefinitionsOperations.delete": "KeyVault.RoleDefinitions.delete",
         "azure.keyvault.administration._generated.operations.RoleDefinitionsOperations.create_or_update": "KeyVault.RoleDefinitions.createOrUpdate",
@@ -80,7 +91,17 @@
         "azure.keyvault.administration._generated.KeyVaultClient.update_ekm_connection": "KeyVault.updateEkmConnection",
         "azure.keyvault.administration._generated.aio.KeyVaultClient.update_ekm_connection": "KeyVault.updateEkmConnection",
         "azure.keyvault.administration._generated.KeyVaultClient.delete_ekm_connection": "KeyVault.deleteEkmConnection",
-        "azure.keyvault.administration._generated.aio.KeyVaultClient.delete_ekm_connection": "KeyVault.deleteEkmConnection"
+        "azure.keyvault.administration._generated.aio.KeyVaultClient.delete_ekm_connection": "KeyVault.deleteEkmConnection",
+        "azure.keyvault.administration._generated.KeyVaultClient.get_ekm_private_endpoint_operation_status": "KeyVault.getEkmPrivateEndpointOperationStatus",
+        "azure.keyvault.administration._generated.aio.KeyVaultClient.get_ekm_private_endpoint_operation_status": "KeyVault.getEkmPrivateEndpointOperationStatus",
+        "azure.keyvault.administration._generated.KeyVaultClient.begin_create_ekm_private_endpoint": "KeyVault.createEkmPrivateEndpoint",
+        "azure.keyvault.administration._generated.aio.KeyVaultClient.begin_create_ekm_private_endpoint": "KeyVault.createEkmPrivateEndpoint",
+        "azure.keyvault.administration._generated.KeyVaultClient.begin_delete_ekm_private_endpoint": "KeyVault.deleteEkmPrivateEndpoint",
+        "azure.keyvault.administration._generated.aio.KeyVaultClient.begin_delete_ekm_private_endpoint": "KeyVault.deleteEkmPrivateEndpoint",
+        "azure.keyvault.administration._generated.KeyVaultClient.get_ekm_private_endpoint": "KeyVault.getEkmPrivateEndpoint",
+        "azure.keyvault.administration._generated.aio.KeyVaultClient.get_ekm_private_endpoint": "KeyVault.getEkmPrivateEndpoint",
+        "azure.keyvault.administration._generated.KeyVaultClient.list_ekm_private_endpoints": "KeyVault.listEkmPrivateEndpoints",
+        "azure.keyvault.administration._generated.aio.KeyVaultClient.list_ekm_private_endpoints": "KeyVault.listEkmPrivateEndpoints"
     },
-    "CrossLanguageVersion": "a3023239f547"
+    "CrossLanguageVersion": "7c52c44e1bdf"
 }

sdk/keyvault/azure-keyvault-administration/assets.json

@@ -2,5 +2,5 @@
   "AssetsRepo": "Azure/azure-sdk-assets",
   "AssetsRepoPrefixPath": "python",
   "TagPrefix": "python/keyvault/azure-keyvault-administration",
-  "Tag": "python/keyvault/azure-keyvault-administration_4f95f3a7da"
+  "Tag": "python/keyvault/azure-keyvault-administration_d47d8124c8"
 }

sdk/keyvault/azure-keyvault-administration/azure/keyvault/administration/__init__.py

@@ -5,11 +5,24 @@
 from ._access_control_client import KeyVaultAccessControlClient
 from ._backup_client import KeyVaultBackupClient
 from ._ekm_client import KeyVaultEkmClient
-from ._enums import KeyVaultDataAction, KeyVaultRoleScope, KeyVaultSettingType
+from ._enums import (
+    KeyVaultDataAction,
+    KeyVaultEkmConnectivityMode,
+    KeyVaultEkmPrivateEndpointConnectionStatus,
+    KeyVaultEkmPrivateEndpointOperationStatus,
+    KeyVaultEkmPrivateEndpointOperationType,
+    KeyVaultEkmPrivateEndpointProvisioningState,
+    KeyVaultRoleScope,
+    KeyVaultSettingType,
+)
 from ._internal.client_base import ApiVersion
 from ._models import (
     KeyVaultBackupResult,
     KeyVaultEkmConnection,
+    KeyVaultEkmPrivateEndpoint,
+    KeyVaultEkmPrivateEndpointConnectionState,
+    KeyVaultEkmPrivateEndpointOperation,
+    KeyVaultEkmPrivateEndpointProperties,
     KeyVaultEkmProxyClientCertificateInfo,
     KeyVaultEkmProxyInfo,
     KeyVaultPermission,
@@ -28,6 +41,15 @@
     "KeyVaultDataAction",
     "KeyVaultEkmClient",
     "KeyVaultEkmConnection",
+    "KeyVaultEkmConnectivityMode",
+    "KeyVaultEkmPrivateEndpoint",
+    "KeyVaultEkmPrivateEndpointConnectionState",
+    "KeyVaultEkmPrivateEndpointConnectionStatus",
+    "KeyVaultEkmPrivateEndpointOperation",
+    "KeyVaultEkmPrivateEndpointOperationStatus",
+    "KeyVaultEkmPrivateEndpointOperationType",
+    "KeyVaultEkmPrivateEndpointProperties",
+    "KeyVaultEkmPrivateEndpointProvisioningState",
     "KeyVaultEkmProxyClientCertificateInfo",
     "KeyVaultEkmProxyInfo",
     "KeyVaultPermission",
@@ -41,4 +63,5 @@
 ]
 
 from ._version import VERSION
+
 __version__ = VERSION