I am trying to find how to update the IP address ranges using the Azure REST API (or .NET SDK). The documentation seems to do not have any information. I tried different requests here https://management.azure.com//subscriptions/{subscriptionId}/providers/Microsoft.DocumentDB/databaseAccounts/{accountName}/firewall without success. Something similar for Azure SQL REST API: https://learn.microsoft.com/en-us/rest/api/sql/2021-02-01-preview/firewall-rules/create-or-update

Hi @Milen Denev , Thanks for using Microsoft Q&A !! You can use Update Rest API to update IP Address ranges. You need to pass only properties you want to update as part of this API request body while calling the API. Your API Request URL will look like below - PATCH https://management.azure.com/subscriptions/{Subscription Id}/resourceGroups/{Resource Group}/providers/Microsoft.DocumentDB/databaseAccounts/{Account Name}?api-version=2021-04-15 API request body will be like below: { "location": "westus", "properties": { "databaseAccountOfferType": "Standard", "ipRules": [ { "ipAddressOrRange": "23.43.230.120" }, { "ipAddressOrRange": "110.12.240.0/12" } ] } } Result: Please let me know if you have any questions. Thanks Saurabh ---------- Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.

Update programmatically (using Azure REST API or .NET SDK) IP address ranges of an Azure Cosmos DB Firewall

Accepted answer

Saurabh Sharma 23,671 Reputation points Microsoft Employee

2021-11-05T21:42:56.65+00:00
Hi @Milen Denev ,

Thanks for using Microsoft Q&A !!
You can use Update Rest API to update IP Address ranges.
You need to pass only properties you want to update as part of this API request body while calling the API.
Your API Request URL will look like below -
PATCH https://management.azure.com/subscriptions/{Subscription Id}/resourceGroups/{Resource Group}/providers/Microsoft.DocumentDB/databaseAccounts/{Account Name}?api-version=2021-04-15

API request body will be like below:

{ "location": "westus", "properties": { "databaseAccountOfferType": "Standard", "ipRules": [ { "ipAddressOrRange": "23.43.230.120" }, { "ipAddressOrRange": "110.12.240.0/12" } ] } }

Result:

Please let me know if you have any questions.

Thanks
Saurabh

----------

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.
Please sign in to rate this answer.
Milen Denev 91 Reputation points

2021-11-06T11:17:57.723+00:00

It partially worked. I quote "You need to pass only properties you want to update as part of this API request body while calling the API". I did a request where I only added ipRules , as the examples shows, and it obliterated (deleted) any other settings I had (like Virtual Networks). Thankfully it wasn't in production. Every application using this Database could lose access.
Please provide information what else I have to add to the request in order to have my Virtual Networks and "Accept connections from within public Azure datacenters" and "Allow access from Azure Portal" setup and turned on.

Saurabh Sharma 23,671 Reputation points Microsoft Employee

2021-11-08T06:58:35.787+00:00

Hi @Milen Denev ,

Apologies for your trouble. I am checking this behavior in my environment and work with the products team internally on this behavior. I will get back to you on the same.

Thanks
Saurabh

Saurabh Sharma 23,671 Reputation points Microsoft Employee

2021-11-09T23:37:13.163+00:00

Hi @Milen Denev ,
Sorry it was my bad, I have provided REST API to do a PUT operation instead of REST which does a PATCH and so you are seeing this behavior as a PUT request essentially replaces the resource with whatever payload you're passing. If that payload doesn't have VNet settings, the resource will be updated accordingly.

So, if you just want to partially update the resource, you should perform a PATCH instead of a PUT. I have updated the answer with the correct API and documentation link.

Also, I have tested this in my environment but I see that one issue that it is not honoring the properties you are talking about and so I am checking internally with the products team and get back to you.

Thanks
Saurabh

Milen Denev 91 Reputation points

2021-11-10T00:02:06.62+00:00

It looks it works as expected. Thank you very much for the support.

Saurabh Sharma 23,671 Reputation points Microsoft Employee

2021-11-10T00:38:44.31+00:00

Great. Thanks @Milen Denev for accepting the answer,

Regarding the properties - "Accept connections from within public Azure datacenters" and "Allow access from Azure Portal", those are part of the IPv4 ranges and simply reflect the IPv4 firewall state, and hence get unchecked if the relevant IPv4 ranges are missing. So, as they are not independent properties, when using PATCH, though you can omit the other properties, you will still need to provide the entire list of IPv4 ranges that you need on the account include these property values.

If not, only the ranges mentioned in the PATCH payload will be honored.
Other ways you can achieve the same is to either GET the account properties, update the IPv4 ranges, and PUT the subsequent payload.

OR, you can GET the account properties, update the IPv4 ranges, and perform a PATCH with the updated list.
Hope this helps.

Thanks
Saurabh
Sign in to comment

Update programmatically (using Azure REST API or .NET SDK) IP address ranges of an Azure Cosmos DB Firewall

0 additional answers