Field platform.azure.customerManagedKey.keyVault.subscriptionId in doc[1] should be moved, because installer does not support to set subscriptionId under keyVault.

$ ./openshift-install explain installconfig.platform.azure.customerManagedKey.keyVault
KIND:     InstallConfig
VERSION:  v1RESOURCE: <object>
  KeyVault is the keyvault used for the customer created key required for encryption.FIELDS:
    keyName <string> -required-
      KeyName is the name of the key vault key.    name <string> -required-
      Name is the name of the key vault.    resourceGroup <string> -required-
      ResourceGroup defines the Azure resource group used by the key
vault.


[1] https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/installing_on_azure/index#installation-config-parameters-azure

    4.16+

    Always

    1.
    2.
    3.