diff --git a/src/KeyVault/KeyVault/ChangeLog.md b/src/KeyVault/KeyVault/ChangeLog.md
index 2664686d2583..05f6739bd5b3 100644
--- a/src/KeyVault/KeyVault/ChangeLog.md
+++ b/src/KeyVault/KeyVault/ChangeLog.md
@@ -18,6 +18,7 @@
         - Additional information about change #1
 -->
 ## Upcoming Release
+* Added upcoming breaking change warning messages to `Get-AzKeyVaultKey` and `Get-AzKeyVaultSecret` for filtering certificate-backed keys and secrets.
 
 ## Version 6.4.2
 * Updated Azure.Core from 1.47.3 to 1.50.0
diff --git a/src/KeyVault/KeyVault/Commands/Key/GetAzureKeyVaultKey.cs b/src/KeyVault/KeyVault/Commands/Key/GetAzureKeyVaultKey.cs
index 1c0c3ab2b665..b0580ba601af 100644
--- a/src/KeyVault/KeyVault/Commands/Key/GetAzureKeyVaultKey.cs
+++ b/src/KeyVault/KeyVault/Commands/Key/GetAzureKeyVaultKey.cs
@@ -19,11 +19,13 @@
 using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
 using Microsoft.Azure.KeyVault.WebKey;
 using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
+using Microsoft.WindowsAzure.Commands.Common.CustomAttributes;
 using System.Linq;
 using System.Management.Automation;
 
 namespace Microsoft.Azure.Commands.KeyVault
 {
+    [GenericBreakingChangeWithVersion("Certificate-backed keys will no longer be returned when listing keys. Use the certificate cmdlets (Get-AzKeyVaultCertificate) to manage these keys.", "16.0.0", "7.0.0")]
     [Cmdlet("Get", ResourceManager.Common.AzureRMConstants.AzurePrefix + "KeyVaultKey", DefaultParameterSetName = ByVaultNameParameterSet)]
     [OutputType(typeof(PSKeyVaultKeyIdentityItem), typeof(PSKeyVaultKey), typeof(PSDeletedKeyVaultKeyIdentityItem), typeof(PSDeletedKeyVaultKey))]
     public class GetAzureKeyVaultKey : KeyVaultCmdletBase
diff --git a/src/KeyVault/KeyVault/Commands/Secret/GetAzureKeyVaultSecret.cs b/src/KeyVault/KeyVault/Commands/Secret/GetAzureKeyVaultSecret.cs
index 470770b0e120..12a90a391031 100644
--- a/src/KeyVault/KeyVault/Commands/Secret/GetAzureKeyVaultSecret.cs
+++ b/src/KeyVault/KeyVault/Commands/Secret/GetAzureKeyVaultSecret.cs
@@ -16,6 +16,7 @@
 using Microsoft.Azure.Commands.KeyVault.Models.Secret;
 using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
 using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
+using Microsoft.WindowsAzure.Commands.Common.CustomAttributes;
 using System;
 using System.Management.Automation;
 using System.Runtime.InteropServices;
@@ -23,6 +24,7 @@
 
 namespace Microsoft.Azure.Commands.KeyVault
 {
+    [GenericBreakingChangeWithVersion("Certificate-backed secrets will no longer be returned when listing secrets. Use the certificate cmdlets (Get-AzKeyVaultCertificate) to manage these secrets.", "16.0.0", "7.0.0")]
     [Cmdlet("Get", ResourceManager.Common.AzureRMConstants.AzurePrefix + "KeyVaultSecret", DefaultParameterSetName = ByVaultNameParameterSet)]
     [OutputType(typeof(PSKeyVaultSecretIdentityItem), typeof(PSKeyVaultSecret), typeof(PSDeletedKeyVaultSecretIdentityItem), typeof(PSDeletedKeyVaultSecret), typeof(string))]
     public class GetAzureKeyVaultSecret : KeyVaultCmdletBase