Skip to content

[Network] az network first-party-service-tag: Add support for First Party Service Tags - #34081

Open
Jian Hui (huiii99) wants to merge 9 commits into
Azure:devfrom
huiii99:feat/network-first-party-service-tag
Open

Jian Hui (huiii99) wants to merge 9 commits into
Azure:devfrom
huiii99:feat/network-first-party-service-tag

Conversation

@huiii99

@huiii99 Jian Hui (huiii99) commented Sep 15, 2026

Copy link
Copy Markdown
Member

Related command
az network first-party-service-tag create
az network first-party-service-tag update
az network first-party-service-tag show
az network first-party-service-tag list
az network first-party-service-tag delete
az network first-party-service-tag wait

az network public-ip create
az network public-ip update
az network public-ip prefix create
az network public-ip prefix update

Description
Fixes #34034.
Azz Azure/aaz#1089.

This PR adds Preview support for managing Microsoft.Network/firstPartyServiceTags resources using Network API version 2025-09-01, including create, update, show, list, delete, and wait operations. Create, update, and delete support asynchronous execution through --no-wait.

It also updates Public IP Address and Public IP Prefix commands to Network API version 2025-09-01 and adds --first-party-service-tag-id support for associating a First Party Service Tag with an IP tag. The existing --ip-tags TYPE=VALUE syntax remains backward compatible.

Because the current Swagger defines resourceGuid under properties while the service returns it at the resource root, this PR adds an AAZ custom response-schema compatibility layer for create, update, show, and list operations.

VM and VMSS changes are outside the scope of this PR.

Testing Guide
azdev test test_network_first_party_service_tag --live

History Notes
[Network] az network first-party-service-tag: Add Preview commands to manage First Party Service Tag resources
[Network] az network public-ip: Add --first-party-service-tag-id to associate a First Party Service Tag with an IP tag
[Network] az network public-ip prefix: Add --ip-tags to update
[Network] az network public-ip prefix: Add --first-party-service-tag-id to associate a First Party Service Tag with an IP tag


This checklist is used to make sure that common guidelines for a pull request are followed.

@yonzhan

Copy link
Copy Markdown
Collaborator

Network

@huiii99

Copy link
Copy Markdown
Member Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).

@a0x1ab

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).

Copilot-Session: f3888681-ef35-48bf-99b8-d97a49e802e0
- Remove subscription-level list, which the service does not support in
  this release, and make --resource-group required for list.
- Update via tags-only PATCH. The generated PUT returns 200 but the
  service silently ignores tag changes, and a PATCH carrying properties
  is rejected with OnlyTagsSupportedForPatch.
- Make resource GUID schema augmentation idempotent so repeated show
  calls no longer raise AAZConflictFieldDefinitionError.
- Fix the scenario test: FirstPartyUsage IP tag value must match the
  service tag value, assert properties.value, use a /31 prefix, and
  cover delete with a tag that has no VIP allocations.
- Add the test recording.

Copilot-Session: 8d0c9141-0426-4c48-b72f-b99447dd9168
@huiii99

Copy link
Copy Markdown
Member Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).

The earlier bulk API version bump for the first party service tag work
also rewrote recorded requests that are not issued by the regenerated
`az network public-ip` commands, which broke cassette playback in CI:

* 10 `Microsoft.Network/publicIPAddresses` requests in the vm module were
  bumped from 2022-01-01 to 2022-05-01, but the vm module still sends
  2022-01-01.
* 3 requests in resource/test_tag_update_by_patch.yaml issued by the
  generic `az resource tag` / `az resource delete` commands were bumped
  from 2024-07-01 to 2025-09-01.

Restore those entries to their original versions and keep the 2025-09-01
bump only for requests coming from the regenerated aaz commands.

Copilot-Session: 8d0c9141-0426-4c48-b72f-b99447dd9168
Regenerating `az network public-ip` and `az network public-ip prefix`
against Network API version 2025-09-01 dropped the `--expand` parameter
from the `show` and `wait` commands, which the breaking change checker
reports as four 1007/ParaRemove violations.

The 2025-09-01 Swagger still declares the optional `$expand` query
parameter for both `PublicIPAddresses_Get` and `PublicIPPrefixes_Get`,
so this is a code generation gap rather than a service change. The same
gap exists for 2025-07-01 and was handled the same way when public-ip
was last regenerated.

Restore the `expand` argument and the `$expand` query parameter so the
commands keep their existing surface.

Copilot-Session: 8d0c9141-0426-4c48-b72f-b99447dd9168
@huiii99
Jian Hui (huiii99) marked this pull request as ready for review September 18, 2026 00:20
Copilot AI lite review requested due to automatic review settings September 18, 2026 00:20

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Unresolved issues remain in validation, listing, update behavior, asynchronous polling, response handling, and API-version recordings.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds Preview AAZ support for First Party Service Tags and associates them with Public IPs and prefixes using Network API 2025-09-01.

Changes:

  • Adds First Party Service Tag CRUD, list, and wait commands.
  • Adds --first-party-service-tag-id to Public IP and prefix commands.
  • Updates schemas, API versions, tests, and recordings.

Unresolved issues remain around validation, subscription-wide listing, GUID handling, update behavior, async polling, and affected recordings.

File summaries
File Summary
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_single_placement_group_default_to_std_lb.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_extended_location.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_create_options.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_create_none_options.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_windows_license_type.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_reimage.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_extended_location.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_zones.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_none_options.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_existing_options.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_existing_nic.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_existing_ids_options.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_custom_ip.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_capture_zone_resilient_image.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_shared_gallery.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_image_version_create_for_diff_source.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_create_vm_with_shared_gallery_image.yaml Refreshes VM scenario recording.
src/azure-cli/azure/cli/command_modules/resource/tests/latest/recordings/test_tag_update_by_patch.yaml Refreshes resource scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_network_commands.py Adds Network command scenario coverage.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_vpn_client_package.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_vnet_gateway_managed_identity.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_private_link_ip_config.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_zoned_public_ip.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_watcher_troubleshooting.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_gateway_sku.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_gateway_package_capture.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_gateway_aad.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_connection_nat_rule.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_connection_ipsec.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_peering.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_peering_sync.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_with_enable_private_ip_address.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_nat_rule_sub_cmd.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_multi_auth1.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_multi_auth.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_migration.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_ipsec.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_expressroute_with_public_ip.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_edge_zone.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_allow_traffic.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_virtual_hub_router_scenario.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_traffic_manager_subnet_routing.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_zone.yaml Refreshes Public IP recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_zone.yaml Refreshes Public IP Prefix recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_with_tier.yaml Refreshes Public IP Prefix recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_with_ip_tags.yaml Refreshes Public IP Prefix recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_edge_zone.yaml Refreshes Public IP Prefix recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_edge_zone.yaml Refreshes Public IP recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_nic.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_nic_subresources.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_load_balancer_outbound_rules.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_lb.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_lb_zone.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_lb_sku.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_cross_region_lb.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_application_gateway_http_settings_validate_flags.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_appgw_creation_with_public_and_private_ip.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_waf_v2_sku.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_trusted_client_cert.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_ssl_profile.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_private_ip.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_defaults.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_cert_name.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_ssl_cert_managed_hsm.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_rewrite_rulesets.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ags_enable_probe_proxy_protocol_header.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ags_enable_l4_client_ip_preservation.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_zone.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_url_path_map.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_url_path_map_edge_case.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_settings.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_rule.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_routing_rule.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_probe.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_probe_with_host_name_from_settings.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_listener.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_listener_with_host_names.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_http_settings.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_http_listener_with_waf_policy.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_http_listener_with_multi_host_names.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_frontend_ip_private.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_manage_appgw_private_endpoint_without_standard.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_ddos_custom_policy_attach_to_lb_fip.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_with_tcp.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_private_endpoint_with_overwrite_default.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_private_endpoint_with_default.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_ag_rule_default_exists.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_ag_rule_create_preserves_http_settings_validate_flags.yaml Refreshes Network scenario recording.
src/azure-cli/azure/cli/command_modules/network/commands.py Registers new and customized commands.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/prefix/_delete.py Updates Public IP Prefix deletion API.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_wait.py Updates Public IP wait API and schema.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_show.py Updates Public IP show API and schema.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_list.py Updates Public IP list API and schema.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_delete.py Updates Public IP deletion API.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_create.py Updates Public IP creation API and schema.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/__init__.py Exports First Party Service Tag commands.
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/__cmd_group.py Defines the Preview command group.
src/azure-cli/azure/cli/command_modules/network/_params.py Adds Public IP service-tag option metadata.
src/azure-cli/azure/cli/command_modules/acs/tests/latest/recordings/test_aks_create_slb_vmss_with_outbound_ip_prefixes_then_update_msi.yaml Refreshes ACS scenario recording.
src/azure-cli/azure/cli/command_modules/acs/tests/latest/recordings/test_aks_create_node_public_ip.yaml Refreshes ACS scenario recording.
Review details

Suppressed comments (4)

src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/_create.py:69

  • The service definition marks FirstPartyServiceTagPropertiesFormat.value as required, but this CLI argument is optional. Omitting --value therefore passes argument parsing and sends a create request without the required property, producing a server-side failure instead of CLI validation; make the argument required and update the generated example to include it.
        _args_schema.value = AAZStrArg(
            options=["--value"],
            arg_group="Properties",
            help="The value of the first party service tag.",
        )

src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/_update.py:22

  • The generated help for update is copied from a create example and also omits the --tags argument that this custom command actually updates. Because AAZ uses this class docstring to build AZ_HELP, users are shown an update command that does not perform an update; replace it with a tags-update example.
    :example: Create first party service tag
        az network first-party-service-tag update --resource-group rg1 --first-party-service-tag-name myServiceTag

src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/_wait.py:184

  • The service response places resourceGuid at the resource root, but this wait schema only defines properties.resourceGuid. Consequently az network first-party-service-tag wait silently drops the GUID even though create/show/list/update expose the compatibility field. Apply the same root-level response-schema customization to the wait command.
            properties.resource_guid = AAZStrType(
                serialized_name="resourceGuid",
                flags={"read_only": True},
            )

src/azure-cli/azure/cli/command_modules/network/custom.py:5259

  • The PATCH customization keeps the generated PUT operation's final-state-via: azure-async-operation, but the FirstPartyServiceTags_UpdateTags API's 202 response uses the Location header for its long-running result. An asynchronous update will therefore not have the URL this poller expects; override the polling configuration for PATCH (or use a generated PATCH operation) so it follows Location.
    class FirstPartyServiceTagsCreateOrUpdate(_FirstPartyServiceTagUpdate.FirstPartyServiceTagsCreateOrUpdate):
        @property
        def method(self):
            return "PATCH"

  • Files reviewed: 136/137 changed files
  • Comments generated: 3
  • Review effort level: Lite

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/azure-cli/azure/cli/command_modules/network/custom.py
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

act-quality-productivity-squad Auto-Assign Auto assign by bot Network az network vnet/lb/nic/dns/etc...

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Azure CLI support for First Party Service Tags

5 participants