Keyvault secret expiry should accept an ISO 8601 timestamp
The built in utcNow and dateTimeAdd functions currently can only format to date/time strings using dotnet format strings so can't output seconds since the epoch. This is a problem because the KeyVault secret expiry only accepts seconds since the epoch (https://docs.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults/secrets) so there's no way to set this value from a template.
The Key Vault resource provider should be updated to accept the ISO 8601 timestamp that dateTimeAdd uses (the output of utcNow('u')). The resource provider could convert the property to an int to keep the api backwards compatible either by allowing 'exp' to be a string or by creating a new write only property that accepts the timestamp, converts it, and then removes it from the property bag.