A secret has a "managed" attribute indicating whether it's managed by Key Vault, i.e. associated with a certificate. SecretProperties expects this attribute but doesn't expose it: