[CI] Handle failures during attempt to delete key vault (#4010)

* Handle failures during attempt to delete key vault

* Better handling errors

build/jobs/add-aad-test-environment.yml

@@ -39,22 +39,43 @@ steps:
       # If a deleted keyvault exists, remove it first
       $environmentName = "$(DeploymentEnvironmentName)".ToLower() -replace "\.", "" 
       Write-Host "Installed module and set variables"
-      if (Get-AzKeyVault -VaultName "${environmentName}-ts" -Location "westus" -InRemovedState)
+
+      $vaultName = "${environmentName}-ts"
+      if (Get-AzKeyVault -VaultName $vaultName -Location "westus" -InRemovedState)
       {
-          Remove-AzKeyVault -VaultName "${environmentName}-ts" -InRemovedState -Location "westus" -Force
-      }
+          Write-Host "Attempting to delete vault ${vaultName}"
+          try
+          {
+              Remove-AzKeyVault -VaultName $vaultName -InRemovedState -Location "westus" -Force
+          }
+          catch
+          {
+              if ($_.ErrorDetails -eq "Operation 'DeletedVaultPurge' is not allowed.")
+              {
+                  # With purge protection enabled, it's impossible to delete a Key Vault before its expiration.
 
+                  Write-Error "Unable to delete vault ${vaultName}."
+                  Write-Error $_.ErrorDetails
+              }
+              else
+              { 
+                  throw $_
+              }
+          }
+      }
       Write-Host "Cleaned up keyvaults"
+
       try 
       {
+          Write-Host "Getting access token"
           $response = Invoke-RestMethod -Method 'Post' -Uri $adTokenUrl -ContentType "application/x-www-form-urlencoded" -Body $body
       }
       catch 
       {
           Write-Error $_.ErrorDetails
       }
-
       Write-Host "Got access token"
+
       Connect-AzureAD -TenantId $tenantId -AadAccessToken $response.access_token -AccountId $clientId
 
       Write-Host "Connected to Azure AD"