[Ben Eshed (bewatersmsft)]

ARM (Control Plane) API Specification Update Pull Request

Tip

Overwhelmed by all this guidance? See the Getting help section at the bottom of this PR description.

PR review workflow diagram

Please understand this diagram before proceeding. It explains how to get your PR approved & merged.

Purpose of this PR

What's the purpose of this PR? Check the specific option that applies. This is mandatory!

• New resource provider.
• New API version for an existing resource provider. (If API spec is not defined in TypeSpec, the PR should have been created in adherence to OpenAPI specs PR creation guidance).
• Update existing version for a new feature. (This is applicable only when you are revising a private preview API version.)
• Update existing version to fix OpenAPI spec quality issues in S360.
• Convert existing OpenAPI spec to TypeSpec spec (do not combine this with implementing changes for a new API version).
• Other, please clarify:
  • edit this with your clarification

Due diligence checklist

To merge this PR, you must go through the following checklist and confirm you understood
and followed the instructions by checking all the boxes:

• I confirm this PR is modifying Azure Resource Manager (ARM) related specifications, and not data plane related specifications.
• I have reviewed following Resource Provider guidelines, including
  ARM resource provider contract and
  REST guidelines (estimated time: 4 hours).
  I understand this is required before I can proceed to the diagram Step 2, "ARM API changes review", for this PR.
• A release plan has been created. If not, please create one as it will help guide you through the REST API and SDK creation process.

Additional information

Viewing API changes

For convenient view of the API changes made by this PR, refer to the URLs provided in the table
in the Generated ApiView comment added to this PR. You can use ApiView to show API versions diff.

Suppressing failures

If one or multiple validation error/warning suppression(s) is detected in your PR, please follow the
suppressions guide to get approval.

Getting help

• First, please carefully read through this PR description, from top to bottom. Please fill out the Purpose of this PR and Due diligence checklist.
• If you don't have permissions to remove or add labels to the PR, request write access per aka.ms/azsdk/access#request-access-to-rest-api-or-sdk-repositories
• To understand what you must do next to merge this PR, see the Next Steps to Merge comment. It will appear within few minutes of submitting this PR and will continue to be up-to-date with current PR state.
• For guidance on fixing this PR CI check failures, see the hyperlinks provided in given failure
  and https://aka.ms/ci-fix.
• For help with ARM review (PR workflow diagram Step 2), see https://aka.ms/azsdk/pr-arm-review.
• If the PR CI checks appear to be stuck in queued state, please add a comment with contents /azp run.
  This should result in a new comment denoting a PR validation pipeline has started and the checks should be updated after few minutes.
• If the help provided by the previous points is not enough, post to https://aka.ms/azsdk/support/specreview-channel and link to this PR.
• For guidance on SDK breaking change review, refer to https://aka.ms/ci-fix.

[github-actions]

Next Steps to Merge

Next steps that must be taken to merge this PR:

• ❌ This PR is in purview of the ARM review (label: ARMReview). This PR must get ARMSignedOff label from an ARM reviewer.
  This PR is awaiting ARM reviewer feedback (label: WaitForARMFeedback).
  To learn when this PR will get reviewed, see ARM review queue at aka.ms/azsdk/pr-arm-review
  For details of the ARM review, see aka.ms/azsdk/pr-arm-review
  
• ❌ The required check named TypeSpec Validation has failed. Refer to the check in the PR's 'Checks' tab for details on how to fix it and consult the aka.ms/ci-fix guide

Other outstanding requirements (4)

• ❌ This PR is in purview of the ARM review (label: ARMReview). This PR must get ARMSignedOff label from an ARM reviewer.
  ❗❗❗ ARM review workflow label is missing! ❗❗❗TO UNBLOCK THIS PR, add /azp run comment to this PR to allow automation to determine where this PR is in the ARM review workflow.
  For details of the ARM review, see aka.ms/azsdk/pr-arm-review
  
• ❌ This PR introduced or changed TypeSpec suppressions that require review.
  Check the TypeSpec suppressions requiring review comment on this PR for the list of suppressions, their justifications, and source locations.
  Reviewers: apply the typespec-suppressions-approved label after confirming every justification is acceptable.
• ❌ The required check named Swagger Avocado has failed. Refer to the check in the PR's 'Checks' tab for details on how to fix it and consult the aka.ms/ci-fix guide
• ❌ The required check named Swagger LintDiff has failed. Refer to the check in the PR's 'Checks' tab for details on how to fix it and consult the aka.ms/ci-fix guide

Comment generated by summarize-checks workflow run.

[Ben Eshed (bewatersmsft)]

Was already signed off here, but missed the cut for 2026-03-01

#47257

[github-actions]

TypeSpec suppressions requiring review

Status: ❌ Approval required — 2 suppressions

This PR adds or updates the TypeSpec suppressions listed below. Suppressions are strongly discouraged — they bypass linter rules that protect API quality and consistency. Authors should avoid adding new suppressions and prefer fixing the underlying issue; reviewers should approve only when there is a clear, compelling justification and no reasonable alternative. Review each linked rule and source location, then apply typespec-suppressions-approved only if every justification is acceptable. The Status column shows ✅ once the label is applied and ❌ while approval is pending.

New suppressions (2)

Status	Rule	Source	Justification
❌	@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage Verify the usage of @customAzureResource decorator.	FirewallPolicySecurityProfile.tsp#L22	Common.SubResourceModel is the established custom Azure resource base for the brownfield firewallPolicy family. A standard ARM resource template would change its id, name, and type envelope and generated SDK hierarchy, so this child must retain the custom resource classification.
❌	@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage Verify the usage of @customAzureResource decorator.	FirewallPolicySecurityProfileGroup.tsp#L22	Common.SubResourceModel is the established custom Azure resource base for the brownfield firewallPolicy family. A standard ARM resource template would change its id, name, and type envelope and generated SDK hierarchy, so this child must retain the custom resource classification.

For an overview of TypeSpec linting rules click here.
For a mapping from ARM lintdiff rules to corresponding TypeSpec linting rules click here.

💬 Have feedback on the TypeSpec suppression flow? Let us know.

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Language	API Review for Package
Go	sdk/resourcemanager/network/armnetwork
Java	com.azure.resourcemanager:azure-resourcemanager-network
JavaScript	@azure/arm-network
Python	azure-mgmt-network

---

Comment generated by After APIView workflow run.

[github-actions]

ARM API Review Summary

Reviewed PR #47827 at head SHA 84efd5a4ea3f5102f517a0639f0a422d4e5b46f4 | Triggered by: pull_request

Approval labels observed: none.

Category	Count
🔴 Blocking	0
🟠 Warning	0
🔵 Suggestion	0

No issues found. The full review covered the added FirewallPolicy security profile and security profile group resources, generated OpenAPI, versioning, LRO metadata, discriminated schemas, examples, and existing discussion; the independent Critic verified the no-findings result.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: suggestion | classification: new | critic: pass | head-sha: 84efd5a

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review

Reviewed the full PR at head SHA 84efd5a4ea3f5102f517a0639f0a422d4e5b46f4. No actionable ARM/API findings were identified. The independent Critic verified the child-resource paths and parent metadata, CRUD/LIST coverage, pageable and long-running-operation metadata, discriminated schemas, required fields, ARM identifiers, versioning, examples, URL and managed-identity fields, suppression justifications, and preservation of the existing signatureOverrides surface.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: suggestion | classification: new | critic: pass | head-sha: 84efd5a

🔍 ARM API review by ARM API Review: Automated Workflow