diff --git a/plugin/plugin.go b/plugin/plugin.go
index 08cd83e..45ac042 100644
--- a/plugin/plugin.go
+++ b/plugin/plugin.go
@@ -69,7 +69,6 @@ func (p *AzurePlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatal
 		// update.
 		return &pb.OnUpdateCatalogResponse{}, nil
 	}
-	sanitizeSecretsFields(secrets)
 	if err := validateSecrets(secrets); err != nil {
 		return nil, err
 	}
@@ -370,13 +369,6 @@ func splitId(in, expectedService, expectedResource string) (string, string, erro
 	return splitId[3], splitId[7], nil
 }
 
-func sanitizeSecretsFields(in *structpb.Struct) {
-	// Only we are allowed to set this value
-	if fields := in.GetFields(); fields != nil {
-		delete(fields, constCredsLastRotatedTime)
-	}
-}
-
 // Returns an invalid argument error with the problematic fields included
 // in the error message.
 func invalidArgumentError(msg string, f map[string]string) error {
diff --git a/plugin/plugin_test.go b/plugin/plugin_test.go
index 42780d3..cfde8b2 100644
--- a/plugin/plugin_test.go
+++ b/plugin/plugin_test.go
@@ -163,6 +163,119 @@ func TestValidateSecrets(t *testing.T) {
 	}
 }
 
+func TestCreateCatalog(t *testing.T) {
+	ctx := context.Background()
+	p := &AzurePlugin{}
+	attrs := wrapMap(t, map[string]interface{}{
+		constDisableCredentialRotation: true,
+		constClientId:                  "client_id",
+		constTenantId:                  "tenant_id",
+		constSubscriptionId:            "sub_id",
+	})
+	secrets := wrapMap(t, map[string]interface{}{
+		constSecretValue: "secret_value",
+		constSecretId:    "secret_id",
+	})
+
+	res, err := p.OnCreateCatalog(ctx, &pb.OnCreateCatalogRequest{Catalog: &hostcatalogs.HostCatalog{
+		Attributes: attrs,
+		Secrets:    secrets,
+	}})
+	require.NoError(t, err)
+	assert.Equal(t, res.GetPersisted().GetSecrets().AsMap(), secrets.AsMap())
+
+	secretsWithExtra := wrapMap(t, map[string]interface{}{
+		constSecretValue: "secret_value",
+		constSecretId:    "secret_id",
+		"extraField":     "extra_value",
+	})
+	res, err = p.OnCreateCatalog(ctx, &pb.OnCreateCatalogRequest{Catalog: &hostcatalogs.HostCatalog{
+		Attributes: attrs,
+		Secrets:    secretsWithExtra,
+	}})
+	require.NoError(t, err)
+	// still only persist the fields we care about.
+	assert.Equal(t, res.GetPersisted().GetSecrets().AsMap(), secrets.AsMap())
+
+	secretsWithRotationTime := wrapMap(t, map[string]interface{}{
+		constSecretValue:          "secret_value",
+		constSecretId:             "secret_id",
+		constCredsLastRotatedTime: "something",
+	})
+	res, err = p.OnCreateCatalog(ctx, &pb.OnCreateCatalogRequest{Catalog: &hostcatalogs.HostCatalog{
+		Attributes: attrs,
+		Secrets:    secretsWithRotationTime,
+	}})
+	assert.Error(t, err)
+}
+
+func TestUpdateCatalog(t *testing.T) {
+	ctx := context.Background()
+	p := &AzurePlugin{}
+
+	oldCatalog := &hostcatalogs.HostCatalog{
+		Attributes: wrapMap(t, map[string]interface{}{
+			constDisableCredentialRotation: true,
+			constClientId:                  "foo",
+			constTenantId:                  "foo",
+			constSubscriptionId:            "foo",
+		}),
+	}
+
+	attrs := wrapMap(t, map[string]interface{}{
+		constDisableCredentialRotation: true,
+		constClientId:                  "client_id",
+		constTenantId:                  "tenant_id",
+		constSubscriptionId:            "sub_id",
+	})
+
+	res, err := p.OnUpdateCatalog(ctx, &pb.OnUpdateCatalogRequest{CurrentCatalog: oldCatalog,
+		NewCatalog: &hostcatalogs.HostCatalog{
+			Attributes: attrs,
+		}})
+	require.NoError(t, err)
+	assert.Nil(t, res.GetPersisted())
+
+	secrets := wrapMap(t, map[string]interface{}{
+		constSecretValue: "secret_value",
+		constSecretId:    "secret_id",
+	})
+
+	res, err = p.OnUpdateCatalog(ctx, &pb.OnUpdateCatalogRequest{CurrentCatalog: oldCatalog,
+		NewCatalog: &hostcatalogs.HostCatalog{
+			Attributes: attrs,
+			Secrets:    secrets,
+		}})
+	require.NoError(t, err)
+	assert.Equal(t, res.GetPersisted().GetSecrets().AsMap(), secrets.AsMap())
+
+	secretsWithExtra := wrapMap(t, map[string]interface{}{
+		constSecretValue: "secret_value",
+		constSecretId:    "secret_id",
+		"extraField":     "extra_value",
+	})
+	res, err = p.OnUpdateCatalog(ctx, &pb.OnUpdateCatalogRequest{CurrentCatalog: oldCatalog,
+		NewCatalog: &hostcatalogs.HostCatalog{
+			Attributes: attrs,
+			Secrets:    secretsWithExtra,
+		}})
+	require.NoError(t, err)
+	// still only persist the fields we care about.
+	assert.Equal(t, res.GetPersisted().GetSecrets().AsMap(), secrets.AsMap())
+
+	secretsWithRotationTime := wrapMap(t, map[string]interface{}{
+		constSecretValue:          "secret_value",
+		constSecretId:             "secret_id",
+		constCredsLastRotatedTime: "something",
+	})
+	res, err = p.OnUpdateCatalog(ctx, &pb.OnUpdateCatalogRequest{CurrentCatalog: oldCatalog,
+		NewCatalog: &hostcatalogs.HostCatalog{
+			Attributes: attrs,
+			Secrets:    secretsWithRotationTime,
+		}})
+	assert.Error(t, err)
+}
+
 func testGetHostStructs(t *testing.T) (*hostcatalogs.HostCatalog, []*hostsets.HostSet) {
 	require := require.New(t)
 	wd, err := os.Getwd()