Key Vault - inplace key update

I have a TF deployment which includes the creation of a Key Vault and after that a specific Key (using resource “azurerm_key_vault_key”). All works well on initial deployment. If I run the deployment a 2nd time, TF Plan reports that the Key will be updated in place:
“azurerm_key_vault_key.MYKEYNAME will be updated in-place”
Nothing has changed so why does it want to update? Is that message something I can prevent using Lifecycle for example?