Microsoft.CognitiveServices accounts/managedNetworks

• Latest
• 2026-03-01
• 2026-01-15-preview
• 2025-12-01
• 2025-10-01-preview

Bicep resource definition

The accounts/managedNetworks resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.CognitiveServices/accounts/managedNetworks resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.CognitiveServices/accounts/managedNetworks@2026-03-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    managedNetwork: {
      firewallSku: 'string'
      isolationMode: 'string'
      managedNetworkKind: 'string'
      outboundRules: {
        {customized property}: {
          category: 'string'
          status: 'string'
          type: 'string'
          // For remaining properties, see OutboundRule objects
        }
      }
      status: {
        status: 'string'
      }
    }
  }
}

OutboundRule objects

Set the type property to specify the type of object.

For FQDN, use:

{
  destination: 'string'
  type: 'FQDN'
}

For PrivateEndpoint, use:

{
  destination: {
    serviceResourceId: 'string'
    subresourceTarget: 'string'
  }
  fqdns: [
    'string'
  ]
  type: 'PrivateEndpoint'
}

For ServiceTag, use:

{
  destination: {
    action: 'string'
    addressPrefixes: [
      'string'
    ]
    portRanges: 'string'
    protocol: 'string'
    serviceTag: 'string'
  }
  type: 'ServiceTag'
}

Property Values

Microsoft.CognitiveServices/accounts/managedNetworks

Name	Description	Value
name	The resource name	string Constraints: Pattern = ^[a-zA-Z0-9][a-zA-Z0-9_-]{2,32}$ (required)
parent	In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource. For more information, see Child resource outside parent resource.	Symbolic name for resource of type: accounts
properties	The properties of the managed network settings of a cognitive services account.	ManagedNetworkSettingsProperties

FqdnOutboundRule

Name	Description	Value
destination		string
type	Type of a managed network Outbound Rule of a cognitive services account.	'FQDN' (required)

ManagedNetworkProvisionStatus

Name	Description	Value
status	Status for the managed network of a cognitive services account.	'Active' 'Inactive'

ManagedNetworkSettingsEx

Name	Description	Value
firewallSku	Firewall Sku used for FQDN Rules	'Basic' 'Standard'
isolationMode	Isolation mode for the managed network of a cognitive services account.	'AllowInternetOutbound' 'AllowOnlyApprovedOutbound' 'Disabled'
managedNetworkKind	The Kind of the managed network. Users can switch from V1 to V2 for granular access controls, but cannot switch back to V1 once V2 is enabled.	'V1' 'V2'
outboundRules	Dictionary of <OutboundRule>	ManagedNetworkSettingsOutboundRules
status	Status of the Provisioning for the managed network of a cognitive services account.	ManagedNetworkProvisionStatus

ManagedNetworkSettingsOutboundRules

Name	Description	Value

ManagedNetworkSettingsProperties

Name	Description	Value
managedNetwork	Managed Network settings for a cognitive services account.	ManagedNetworkSettingsEx

OutboundRule

Name	Description	Value
category	Category of a managed network Outbound Rule of a cognitive services account.	'Dependency' 'Recommended' 'Required' 'UserDefined'
status	Type of a managed network Outbound Rule of a cognitive services account.	'Active' 'Deleting' 'Failed' 'Inactive' 'Provisioning'
type	Set to 'FQDN' for type FqdnOutboundRule. Set to 'PrivateEndpoint' for type PrivateEndpointOutboundRule. Set to 'ServiceTag' for type ServiceTagOutboundRule.	'FQDN' 'PrivateEndpoint' 'ServiceTag' (required)

PrivateEndpointOutboundRule

Name	Description	Value
destination	Private Endpoint destination.	PrivateEndpointOutboundRuleDestination
fqdns	List of FQDNs associated with the private endpoint outbound rule.	string[]
type	Type of a managed network Outbound Rule of a cognitive services account.	'PrivateEndpoint' (required)

PrivateEndpointOutboundRuleDestination

Name	Description	Value
serviceResourceId	The Azure resource ID of the target private endpoint service.	string
subresourceTarget	The subresource of the target service to connect to.	string

ServiceTagOutboundRule

Name	Description	Value
destination	Service Tag destination.	ServiceTagOutboundRuleDestination
type	Type of a managed network Outbound Rule of a cognitive services account.	'ServiceTag' (required)

ServiceTagOutboundRuleDestination

Name	Description	Value
action	The action for the service tag outbound rule.	'Allow' 'Deny'
addressPrefixes	Optional address prefixes. If provided, the serviceTag property will be ignored.	string[]
portRanges	Destination port ranges.	string
protocol	Network protocol used by the service tag rule.	string
serviceTag	Name of the Azure service tag to target.	string

ARM template resource definition

The accounts/managedNetworks resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.CognitiveServices/accounts/managedNetworks resource, add the following JSON to your template.

{
  "type": "Microsoft.CognitiveServices/accounts/managedNetworks",
  "apiVersion": "2026-03-01",
  "name": "string",
  "properties": {
    "managedNetwork": {
      "firewallSku": "string",
      "isolationMode": "string",
      "managedNetworkKind": "string",
      "outboundRules": {
        "{customized property}": {
          "category": "string",
          "status": "string",
          "type": "string"
          // For remaining properties, see OutboundRule objects
        }
      },
      "status": {
        "status": "string"
      }
    }
  }
}

OutboundRule objects

Set the type property to specify the type of object.

For FQDN, use:

{
  "destination": "string",
  "type": "FQDN"
}

For PrivateEndpoint, use:

{
  "destination": {
    "serviceResourceId": "string",
    "subresourceTarget": "string"
  },
  "fqdns": [ "string" ],
  "type": "PrivateEndpoint"
}

For ServiceTag, use:

{
  "destination": {
    "action": "string",
    "addressPrefixes": [ "string" ],
    "portRanges": "string",
    "protocol": "string",
    "serviceTag": "string"
  },
  "type": "ServiceTag"
}

Property Values

Microsoft.CognitiveServices/accounts/managedNetworks

Name	Description	Value
apiVersion	The api version	'2026-03-01'
name	The resource name	string Constraints: Pattern = ^[a-zA-Z0-9][a-zA-Z0-9_-]{2,32}$ (required)
properties	The properties of the managed network settings of a cognitive services account.	ManagedNetworkSettingsProperties
type	The resource type	'Microsoft.CognitiveServices/accounts/managedNetworks'

FqdnOutboundRule

Name	Description	Value
destination		string
type	Type of a managed network Outbound Rule of a cognitive services account.	'FQDN' (required)

ManagedNetworkProvisionStatus

Name	Description	Value
status	Status for the managed network of a cognitive services account.	'Active' 'Inactive'

ManagedNetworkSettingsEx

Name	Description	Value
firewallSku	Firewall Sku used for FQDN Rules	'Basic' 'Standard'
isolationMode	Isolation mode for the managed network of a cognitive services account.	'AllowInternetOutbound' 'AllowOnlyApprovedOutbound' 'Disabled'
managedNetworkKind	The Kind of the managed network. Users can switch from V1 to V2 for granular access controls, but cannot switch back to V1 once V2 is enabled.	'V1' 'V2'
outboundRules	Dictionary of <OutboundRule>	ManagedNetworkSettingsOutboundRules
status	Status of the Provisioning for the managed network of a cognitive services account.	ManagedNetworkProvisionStatus

ManagedNetworkSettingsOutboundRules

Name	Description	Value

ManagedNetworkSettingsProperties

Name	Description	Value
managedNetwork	Managed Network settings for a cognitive services account.	ManagedNetworkSettingsEx

OutboundRule

Name	Description	Value
category	Category of a managed network Outbound Rule of a cognitive services account.	'Dependency' 'Recommended' 'Required' 'UserDefined'
status	Type of a managed network Outbound Rule of a cognitive services account.	'Active' 'Deleting' 'Failed' 'Inactive' 'Provisioning'
type	Set to 'FQDN' for type FqdnOutboundRule. Set to 'PrivateEndpoint' for type PrivateEndpointOutboundRule. Set to 'ServiceTag' for type ServiceTagOutboundRule.	'FQDN' 'PrivateEndpoint' 'ServiceTag' (required)

PrivateEndpointOutboundRule

Name	Description	Value
destination	Private Endpoint destination.	PrivateEndpointOutboundRuleDestination
fqdns	List of FQDNs associated with the private endpoint outbound rule.	string[]
type	Type of a managed network Outbound Rule of a cognitive services account.	'PrivateEndpoint' (required)

PrivateEndpointOutboundRuleDestination

Name	Description	Value
serviceResourceId	The Azure resource ID of the target private endpoint service.	string
subresourceTarget	The subresource of the target service to connect to.	string

ServiceTagOutboundRule

Name	Description	Value
destination	Service Tag destination.	ServiceTagOutboundRuleDestination
type	Type of a managed network Outbound Rule of a cognitive services account.	'ServiceTag' (required)

ServiceTagOutboundRuleDestination

Name	Description	Value
action	The action for the service tag outbound rule.	'Allow' 'Deny'
addressPrefixes	Optional address prefixes. If provided, the serviceTag property will be ignored.	string[]
portRanges	Destination port ranges.	string
protocol	Network protocol used by the service tag rule.	string
serviceTag	Name of the Azure service tag to target.	string

Usage Examples

Terraform (AzAPI provider) resource definition

The accounts/managedNetworks resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.CognitiveServices/accounts/managedNetworks resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.CognitiveServices/accounts/managedNetworks@2026-03-01"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      managedNetwork = {
        firewallSku = "string"
        isolationMode = "string"
        managedNetworkKind = "string"
        outboundRules = {
          {customized property} = {
            category = "string"
            status = "string"
            type = "string"
            // For remaining properties, see OutboundRule objects
          }
        }
        status = {
          status = "string"
        }
      }
    }
  }
}

OutboundRule objects

Set the type property to specify the type of object.

For FQDN, use:

{
  destination = "string"
  type = "FQDN"
}

For PrivateEndpoint, use:

{
  destination = {
    serviceResourceId = "string"
    subresourceTarget = "string"
  }
  fqdns = [
    "string"
  ]
  type = "PrivateEndpoint"
}

For ServiceTag, use:

{
  destination = {
    action = "string"
    addressPrefixes = [
      "string"
    ]
    portRanges = "string"
    protocol = "string"
    serviceTag = "string"
  }
  type = "ServiceTag"
}

Property Values

Microsoft.CognitiveServices/accounts/managedNetworks

Name	Description	Value
name	The resource name	string Constraints: Pattern = ^[a-zA-Z0-9][a-zA-Z0-9_-]{2,32}$ (required)
parent_id	The ID of the resource that is the parent for this resource.	ID for resource of type: accounts
properties	The properties of the managed network settings of a cognitive services account.	ManagedNetworkSettingsProperties
type	The resource type	"Microsoft.CognitiveServices/accounts/managedNetworks@2026-03-01"

FqdnOutboundRule

Name	Description	Value
destination		string
type	Type of a managed network Outbound Rule of a cognitive services account.	'FQDN' (required)

ManagedNetworkProvisionStatus

Name	Description	Value
status	Status for the managed network of a cognitive services account.	'Active' 'Inactive'

ManagedNetworkSettingsEx

Name	Description	Value
firewallSku	Firewall Sku used for FQDN Rules	'Basic' 'Standard'
isolationMode	Isolation mode for the managed network of a cognitive services account.	'AllowInternetOutbound' 'AllowOnlyApprovedOutbound' 'Disabled'
managedNetworkKind	The Kind of the managed network. Users can switch from V1 to V2 for granular access controls, but cannot switch back to V1 once V2 is enabled.	'V1' 'V2'
outboundRules	Dictionary of <OutboundRule>	ManagedNetworkSettingsOutboundRules
status	Status of the Provisioning for the managed network of a cognitive services account.	ManagedNetworkProvisionStatus

ManagedNetworkSettingsOutboundRules

Name	Description	Value

ManagedNetworkSettingsProperties

Name	Description	Value
managedNetwork	Managed Network settings for a cognitive services account.	ManagedNetworkSettingsEx

OutboundRule

Name	Description	Value
category	Category of a managed network Outbound Rule of a cognitive services account.	'Dependency' 'Recommended' 'Required' 'UserDefined'
status	Type of a managed network Outbound Rule of a cognitive services account.	'Active' 'Deleting' 'Failed' 'Inactive' 'Provisioning'
type	Set to 'FQDN' for type FqdnOutboundRule. Set to 'PrivateEndpoint' for type PrivateEndpointOutboundRule. Set to 'ServiceTag' for type ServiceTagOutboundRule.	'FQDN' 'PrivateEndpoint' 'ServiceTag' (required)

PrivateEndpointOutboundRule

Name	Description	Value
destination	Private Endpoint destination.	PrivateEndpointOutboundRuleDestination
fqdns	List of FQDNs associated with the private endpoint outbound rule.	string[]
type	Type of a managed network Outbound Rule of a cognitive services account.	'PrivateEndpoint' (required)

PrivateEndpointOutboundRuleDestination

Name	Description	Value
serviceResourceId	The Azure resource ID of the target private endpoint service.	string
subresourceTarget	The subresource of the target service to connect to.	string

ServiceTagOutboundRule

Name	Description	Value
destination	Service Tag destination.	ServiceTagOutboundRuleDestination
type	Type of a managed network Outbound Rule of a cognitive services account.	'ServiceTag' (required)

ServiceTagOutboundRuleDestination

Name	Description	Value
action	The action for the service tag outbound rule.	'Allow' 'Deny'
addressPrefixes	Optional address prefixes. If provided, the serviceTag property will be ignored.	string[]
portRanges	Destination port ranges.	string
protocol	Network protocol used by the service tag rule.	string
serviceTag	Name of the Azure service tag to target.	string