diff --git a/sdk/keyvault/keyvault-secrets/CHANGELOG.md b/sdk/keyvault/keyvault-secrets/CHANGELOG.md
index afb2c803d8e9..9ef9af10c0e1 100644
--- a/sdk/keyvault/keyvault-secrets/CHANGELOG.md
+++ b/sdk/keyvault/keyvault-secrets/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## 4.2.0-beta.3 (Unreleased)
 
 - Updated the Latest service version to 7.2.
+- Added a `certificateKeyId?: string` secret property to use instead of the deprecated `keyId?: URL` and removed `"lib": ["dom"]` from `tsconfig.json`
 
 ## 4.2.0-beta.2 (2021-02-09)
 
diff --git a/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md b/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md
index 64637ccf79ed..f0af30f2a1e1 100644
--- a/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md
+++ b/sdk/keyvault/keyvault-secrets/review/keyvault-secrets.api.md
@@ -137,12 +137,14 @@ export interface SecretPollerOptions extends coreHttp.OperationOptions {
 
 // @public
 export interface SecretProperties {
+    readonly certificateKeyId?: string;
     contentType?: string;
     readonly createdOn?: Date;
     enabled?: boolean;
     readonly expiresOn?: Date;
     id?: string;
-    readonly keyId?: URL;
+    // @deprecated
+    readonly keyId?: unknown;
     readonly managed?: boolean;
     name: string;
     readonly notBefore?: Date;
diff --git a/sdk/keyvault/keyvault-secrets/src/secretsModels.ts b/sdk/keyvault/keyvault-secrets/src/secretsModels.ts
index 89ed8eb638c4..9333c15c272c 100644
--- a/sdk/keyvault/keyvault-secrets/src/secretsModels.ts
+++ b/sdk/keyvault/keyvault-secrets/src/secretsModels.ts
@@ -83,8 +83,18 @@ export interface SecretProperties {
    * this field specifies the corresponding key backing the KV certificate.
    * **NOTE: This property will not be serialized. It can only be populated by
    * the server.**
+   * @deprecated Please use {@link SecretProperties.certificateKeyId} instead. This field will always be undefined.
    */
-  readonly keyId?: URL;
+  readonly keyId?: unknown;
+
+  /**
+   * If this is a secret backing a KV certificate, then
+   * this field specifies the identifier of the corresponding key backing the KV certificate.
+   * **NOTE: This property will not be serialized. It can only be populated by
+   * the server.**
+   */
+  readonly certificateKeyId?: string;
+
   /**
    * True if the secret's lifetime is managed by
    * key vault. If this is a secret backing a certificate, then managed will be
diff --git a/sdk/keyvault/keyvault-secrets/src/transformations.ts b/sdk/keyvault/keyvault-secrets/src/transformations.ts
index 73adeef9e75a..9ebe109c9469 100644
--- a/sdk/keyvault/keyvault-secrets/src/transformations.ts
+++ b/sdk/keyvault/keyvault-secrets/src/transformations.ts
@@ -38,7 +38,8 @@ export function getSecretFromSecretBundle(
 
       vaultUrl: parsedId.vaultUrl,
       version: parsedId.version,
-      name: parsedId.name
+      name: parsedId.name,
+      certificateKeyId: secretBundle.kid
     }
   };
 
diff --git a/sdk/keyvault/keyvault-secrets/test/internal/transformations.spec.ts b/sdk/keyvault/keyvault-secrets/test/internal/transformations.spec.ts
index de38374c4f1b..336d0df0e116 100644
--- a/sdk/keyvault/keyvault-secrets/test/internal/transformations.spec.ts
+++ b/sdk/keyvault/keyvault-secrets/test/internal/transformations.spec.ts
@@ -50,7 +50,8 @@ describe("Transformations", () => {
         managed: true,
         vaultUrl: "https://azure_keyvault.vault.azure.net",
         version: "1",
-        name: "abc123"
+        name: "abc123",
+        certificateKeyId: "test_kid"
       }
     };
 
diff --git a/sdk/keyvault/keyvault-secrets/tsconfig.json b/sdk/keyvault/keyvault-secrets/tsconfig.json
index 7a5252578c4f..39e5962ffd82 100644
--- a/sdk/keyvault/keyvault-secrets/tsconfig.json
+++ b/sdk/keyvault/keyvault-secrets/tsconfig.json
@@ -3,7 +3,6 @@
   "compilerOptions": {
     "declarationDir": "./types",
     "outDir": "./dist-esm",
-    "lib": ["dom"],
     "resolveJsonModule": true
   },
   "exclude": ["node_modules", "../keyvault-common/node_modules", "./samples/**/*.ts"],