diff --git a/cmd/vcert/cmdCloudKeystores.go b/cmd/vcert/cmdCloudKeystores.go
index f33bc7a4..0f75e0f7 100644
--- a/cmd/vcert/cmdCloudKeystores.go
+++ b/cmd/vcert/cmdCloudKeystores.go
@@ -91,7 +91,7 @@ func doCommandProvisionCloudKeystore(c *cli.Context) error {
 	result.MachineIdentityId = metadata.GetMachineIdentityMetadata().GetID()
 	result.MachineIdentityActionType = metadata.GetMachineIdentityMetadata().GetActionType()
 
-	err = result.Flush(flags.provisionFormat)
+	err = result.Flush(flags.provisionFormat, flags.provisionOutputFile)
 
 	if err != nil {
 		return fmt.Errorf("failed to output the results: %s", err)
diff --git a/cmd/vcert/flags.go b/cmd/vcert/flags.go
index 56f9f107..9f8ff6c9 100644
--- a/cmd/vcert/flags.go
+++ b/cmd/vcert/flags.go
@@ -907,7 +907,7 @@ var (
 		flagKeystoreName,
 		flagKeystoreID,
 		flagProvisionFormat,
-		flagProvisionOutputFile, // TODO: implement this flag
+		flagProvisionOutputFile,
 	)
 
 	commonCredFlags = []cli.Flag{flagConfig, flagProfile, flagUrl, flagToken, flagTrustBundle}
diff --git a/cmd/vcert/result_writer.go b/cmd/vcert/result_writer.go
index a2aaaf5f..77b13db2 100644
--- a/cmd/vcert/result_writer.go
+++ b/cmd/vcert/result_writer.go
@@ -447,13 +447,18 @@ func outputJSON(resp interface{}) error {
 	return err
 }
 
-func (r *ProvisioningResult) Flush(format string) error {
+func (r *ProvisioningResult) Flush(format string, filePath string) error {
 
 	result, err := r.Format(format)
 	if err != nil {
 		return err
 	}
 
+	if filePath != "" {
+		err = r.WriteFile(result, filePath)
+		return err
+	}
+
 	_, err = fmt.Fprint(os.Stdout, result)
 	if err != nil {
 		return fmt.Errorf("failed to print provisioning result to STDOUT: %w", err)
@@ -462,6 +467,14 @@ func (r *ProvisioningResult) Flush(format string) error {
 	return nil
 }
 
+func (r *ProvisioningResult) WriteFile(result string, filePath string) error {
+	err := os.WriteFile(filePath, []byte(result), 0600)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func (r *ProvisioningResult) Format(format string) (string, error) {
 	result := ""
 	switch strings.ToLower(format) {
diff --git a/cmd/vcert/validators.go b/cmd/vcert/validators.go
index 914e20b8..3bc2f49f 100644
--- a/cmd/vcert/validators.go
+++ b/cmd/vcert/validators.go
@@ -732,8 +732,17 @@ func validateProvisionFlags(commandName string) error {
 		return fmt.Errorf("unexpected output format: %s", flags.format)
 	}
 
-	if flags.certificateID == "" && flags.provisionPickupID == "" {
-		return fmt.Errorf("please, provide any of certificate-id or pickup-id")
+	if flags.certificateID == "" && flags.provisionPickupID == "" && flags.pickupIDFile == "" {
+		return fmt.Errorf("please, provide any of --certificate-id or --pickup-id or --pickup-id-file")
+	}
+
+	if flags.pickupIDFile != "" {
+		if flags.pickupID != "" {
+			return fmt.Errorf("both --pickup-id and --pickup-id-file options cannot be specified at the same time")
+		}
+		if flags.certificateID != "" {
+			return fmt.Errorf("both --certificate-id and --pickup-id-file options cannot be specified at the same time")
+		}
 	}
 
 	if flags.keystoreID == "" {