diff --git a/azurerm/internal/services/apimanagement/api_management_subscription_resource.go b/azurerm/internal/services/apimanagement/api_management_subscription_resource.go
index d015a48241cd..c2a4dd27dbeb 100644
--- a/azurerm/internal/services/apimanagement/api_management_subscription_resource.go
+++ b/azurerm/internal/services/apimanagement/api_management_subscription_resource.go
@@ -187,13 +187,19 @@ func resourceArmApiManagementSubscriptionRead(d *schema.ResourceData, meta inter
 
 	if props := resp.SubscriptionContractProperties; props != nil {
 		d.Set("display_name", props.DisplayName)
-		d.Set("primary_key", props.PrimaryKey)
-		d.Set("secondary_key", props.SecondaryKey)
 		d.Set("state", string(props.State))
 		d.Set("product_id", props.Scope)
 		d.Set("user_id", props.OwnerID)
 	}
 
+	// Primary and secondary keys must be got from this additional api
+	keyResp, err := client.ListSecrets(ctx, resourceGroup, serviceName, subscriptionId)
+	if err != nil {
+		return fmt.Errorf("listing Subscription %q Primary and Secondary Keys (API Management Service %q / Resource Group %q): %+v", subscriptionId, serviceName, resourceGroup, err)
+	}
+	d.Set("primary_key", keyResp.PrimaryKey)
+	d.Set("secondary_key", keyResp.SecondaryKey)
+
 	return nil
 }
 
diff --git a/azurerm/internal/services/apimanagement/tests/api_management_subscription_resource_test.go b/azurerm/internal/services/apimanagement/tests/api_management_subscription_resource_test.go
index b9b029821e3e..a709f9c18c56 100644
--- a/azurerm/internal/services/apimanagement/tests/api_management_subscription_resource_test.go
+++ b/azurerm/internal/services/apimanagement/tests/api_management_subscription_resource_test.go
@@ -24,6 +24,8 @@ func TestAccAzureRMAPIManagementSubscription_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMAPIManagementSubscriptionExists(data.ResourceName),
 					resource.TestCheckResourceAttrSet(data.ResourceName, "subscription_id"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "primary_key"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "secondary_key"),
 				),
 			},
 			data.ImportStep(),
@@ -44,6 +46,8 @@ func TestAccAzureRMAPIManagementSubscription_requiresImport(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMAPIManagementSubscriptionExists(data.ResourceName),
 					resource.TestCheckResourceAttrSet(data.ResourceName, "subscription_id"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "primary_key"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "secondary_key"),
 				),
 			},
 			data.RequiresImportErrorStep(testAccAzureRMAPIManagementSubscription_requiresImport),
@@ -65,6 +69,8 @@ func TestAccAzureRMAPIManagementSubscription_update(t *testing.T) {
 					testCheckAzureRMAPIManagementSubscriptionExists(data.ResourceName),
 					resource.TestCheckResourceAttr(data.ResourceName, "state", "submitted"),
 					resource.TestCheckResourceAttrSet(data.ResourceName, "subscription_id"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "primary_key"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "secondary_key"),
 				),
 			},
 			{
@@ -106,6 +112,8 @@ func TestAccAzureRMAPIManagementSubscription_complete(t *testing.T) {
 					testCheckAzureRMAPIManagementSubscriptionExists(data.ResourceName),
 					resource.TestCheckResourceAttr(data.ResourceName, "state", "active"),
 					resource.TestCheckResourceAttrSet(data.ResourceName, "subscription_id"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "primary_key"),
+					resource.TestCheckResourceAttrSet(data.ResourceName, "secondary_key"),
 				),
 			},
 			data.ImportStep(),