def main():
    '''Main routine.'''
    # validate command line arguments
    arg_parser = argparse.ArgumentParser()

    arg_parser.add_argument('--add', '-a', action='store_true', default=False,  help='add a key vault')
    arg_parser.add_argument('--delete', '-d', action='store_true', default=False,  help='delete a key vault')
    arg_parser.add_argument('--name', '-n', required=True, action='store', help='Name')
    arg_parser.add_argument('--rgname', '-g', required=True, action='store',
                            help='Resource Group Name')
    arg_parser.add_argument('--location', '-l', required=True, action='store',
                            help='Location, e.g. eastus')
    arg_parser.add_argument('--verbose', '-v', action='store_true', default=False,
                            help='Print operational details')

    args = arg_parser.parse_args()
    name = args.name
    rgname = args.rgname
    location = args.location

    if args.add is True and args.delete is True:
        sys.exit('Specify --add or --delete, not both.')
    if args.add is False and args.delete is False: 
        sys.exit('No operation specified, use --add or --delete.')

    if 'ACC_CLOUD' in os.environ and 'MSI_ENDPOINT' in os.environ:
        endpoint = os.environ['MSI_ENDPOINT']
    else:
        sys.exit('Not running in cloud shell or MSI_ENDPOINT not set') 

    # get Azure auth token
    if args.verbose is True:
        print('Getting Azure token from MSI endpoint..')

    access_token = azurerm.get_access_token_from_cli()

    if args.verbose is True:
        print('Getting Azure subscription ID from MSI endpoint..')
    subscription_id = azurerm.get_subscription_from_cli()

    # execute specified operation
    if  args.add is True: # create a key vault
        # get Azure tenant ID
        if args.verbose is True:
            print('Getting list of tenant IDs...')
        tenants = azurerm.list_tenants(access_token)
        tenant_id = tenants['value'][0]['tenantId']
        if args.verbose is True:
            print('My tenantId = ' + tenant_id)

        # get Graph object ID
        if args.verbose is True:
            print('Querying graph...')
        object_id = azurerm.get_object_id_from_graph()
        if args.verbose is True:
            print('My object ID = ' + object_id)

        # create key vault
        ret = azurerm.create_keyvault(access_token, subscription_id, rgname, name, location, tenant_id=tenant_id, object_id=object_id)
        if ret.status_code == 200:
            print('Successsfully created key vault: ' + name)
            print('Vault URI: ' + ret.json()['properties']['vaultUri'])
        else:
            print('Return code ' + str(ret.status_code) + ' from create_keyvault().')
            print(ret.text)

    # else delete named key vault
    else:
        ret = azurerm.delete_keyvault(access_token, subscription_id, rgname, name)
        if ret.status_code == 200:
            print('Successsfully deleted key vault: ' + name)
        else:
            print('Return code ' + str(ret.status_code) + ' from delete_keyvault().')
            print(ret.text)