This works fine for this case, the use case here is not data entries for existing secrets in existing keyvaults, the use case here is for creating keyvaults with the azurerm_key_vault resource. If you don’t explicitly point it to a provider (in which case I understand it should take the default provider, everything else does at least and consistently) it always seems to create it in the default provider, but then when it tries to read it on future runs it can be either the default subscription or the other one that should need an alias.
I have found a workaround where we’ve created a whole new provider alias that points to the same place as the default provider and explicitly point it towards that. Even if we explicitly pointed it to the default provider it still would sometimes point to the other alias.
NB: Apologies if my terminology about default providers/aliases/etc is wrong. I’m not 100% sure I know the right terminology here. If I need to clarify something please let me know and I’ll happily do so.