Under https://docs.microsoft.com/en-us/azure/key-vault/key-vault-group-permissions-for-apps#give-the-principal-access-to-your-key-vault the "az keyvault set-policy ..." command should use the "--object-id" flag instead of the "--spn" flag to pass the objectId.
⚠Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
@BassFaceIV
Thanks for your feedback! We will investigate and update as appropriate.
@BassFaceIV since object-id is by GUID and upn is by name, I think you're correct.
I made a pull request for approval by @msmbaldwin https://github.com/MicrosoftDocs/azure-docs-pr/pull/93804