Key Vault has custom diagnostic headers whose values are by default redacted by HttpLoggingPolicy. Preventing that redaction requires instantiating a policy then modifying its allow list:

It would be nice if the policy instead accepted these as optional keyword arguments, enabling usage like

HttpLoggingPolicy(additional_allowed_headers=["x-key-vault-stuff"])

or

HttpLoggingPolicy(allowed_headers=HttpLoggingPolicy.DEFAULT_ALLOWED_HEADERS.union(["x-key-vault-stuff"]))