diff --git a/internal/services/keyvault/key_vault_certificates_data_source.go b/internal/services/keyvault/key_vault_certificates_data_source.go
index bd93d46d4adb..674f28303d75 100644
--- a/internal/services/keyvault/key_vault_certificates_data_source.go
+++ b/internal/services/keyvault/key_vault_certificates_data_source.go
@@ -12,6 +12,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/keyvault/parse"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/tags"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/timeouts"
 	"github.com/hashicorp/terraform-provider-azurerm/utils"
@@ -62,6 +63,8 @@ func dataSourceKeyVaultCertificates() *pluginsdk.Resource {
 							Type:     pluginsdk.TypeBool,
 							Computed: true,
 						},
+
+						"tags": tags.SchemaDataSource(),
 					},
 				},
 			},
@@ -125,8 +128,14 @@ func expandCertificate(name string, item keyvault.CertificateItem) map[string]in
 		"name": name,
 		"id":   *item.ID,
 	}
+
 	if item.Attributes != nil && item.Attributes.Enabled != nil {
 		cert["enabled"] = *item.Attributes.Enabled
 	}
+
+	if item.Tags != nil {
+		cert["tags"] = tags.Flatten(item.Tags)
+	}
+
 	return cert
 }
diff --git a/internal/services/keyvault/key_vault_secrets_data_source.go b/internal/services/keyvault/key_vault_secrets_data_source.go
index e1d0c34e8bfe..606902208e99 100644
--- a/internal/services/keyvault/key_vault_secrets_data_source.go
+++ b/internal/services/keyvault/key_vault_secrets_data_source.go
@@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/go-azure-helpers/resourcemanager/commonschema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/tags"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/timeouts"
 	"github.com/hashicorp/terraform-provider-azurerm/utils"
@@ -57,6 +58,8 @@ func dataSourceKeyVaultSecrets() *pluginsdk.Resource {
 							Type:     pluginsdk.TypeBool,
 							Computed: true,
 						},
+
+						"tags": tags.SchemaDataSource(),
 					},
 				},
 			},
@@ -132,8 +135,14 @@ func expandSecrets(name string, item keyvault.SecretItem) map[string]interface{}
 		"id":   *item.ID,
 		"name": name,
 	}
+
 	if item.Attributes != nil && item.Attributes.Enabled != nil {
 		res["enabled"] = *item.Attributes.Enabled
 	}
+
+	if item.Tags != nil {
+		res["tags"] = tags.Flatten(item.Tags)
+	}
+
 	return res
 }
diff --git a/website/docs/d/key_vault_certificates.html.markdown b/website/docs/d/key_vault_certificates.html.markdown
index 5762f308a7fe..e30b3914fc26 100644
--- a/website/docs/d/key_vault_certificates.html.markdown
+++ b/website/docs/d/key_vault_certificates.html.markdown
@@ -49,9 +49,13 @@ In addition to the arguments above, the following attributes are exported:
 
 A `certificates` block supports following:
 
-* `name` - The name of secret.
+* `name` - The name of certificate.
 
-* `enabled` - Whether this secret is enabled.
+* `enabled` - Whether this certificate is enabled.
+
+* `id` - The ID of this certificate.
+
+* `tags` - The tags of this certificate.
 
 ## Timeouts
 
diff --git a/website/docs/d/key_vault_secrets.html.markdown b/website/docs/d/key_vault_secrets.html.markdown
index ab9d89b8407a..8375fdf52028 100644
--- a/website/docs/d/key_vault_secrets.html.markdown
+++ b/website/docs/d/key_vault_secrets.html.markdown
@@ -51,6 +51,8 @@ A `secrets` block supports following:
 
 * `id` - The ID of this secret.
 
+* `tags` - The tags of this secret.
+
 ## Timeouts
 
 The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/language/resources/syntax#operation-timeouts) for certain actions: