az agentfabric

Note

This reference is part of the agentfabric extension for the Azure CLI (version 2.75.0 or higher). The extension will automatically install the first time you run an az agentfabric command. Learn more about extensions.

Manage Agent Fabric and related Microsoft.NetworkSecurity resources. Root commands manage Agent Fabric resources.

Manage Agent Fabric and related Microsoft.NetworkSecurity resources. Root create, show, list, update, and delete commands manage Agent Fabric resources.

Commands

Name	Description	Type	Status
az agentfabric aks	Manage Agent Fabric compute enrollment.	Extension	GA
az agentfabric aks attach	Attach a compute resource to an Agent Fabric.	Extension	GA
az agentfabric aks detach	Delete an Agent Fabric compute association.	Extension	GA
az agentfabric aks list	List compute associations under an Agent Fabric.	Extension	GA
az agentfabric aks show	Show an Agent Fabric compute association.	Extension	GA
az agentfabric aks update	Patch enrollment tags, SKU, or gateway IP.	Extension	GA
az agentfabric aks wait	Place the CLI in a waiting state until a condition is met.	Extension	GA
az agentfabric create	Create or replace an Agent Fabric resource.	Extension	GA
az agentfabric delete	Delete an Agent Fabric resource.	Extension	GA
az agentfabric egress-trust-bundle	Read Agent Fabric egress trust bundles.	Extension	GA
az agentfabric egress-trust-bundle list	List egress trust bundles for an Agent Fabric.	Extension	GA
az agentfabric egress-trust-bundle show	Show the default egress trust bundle for an Agent Fabric.	Extension	GA
az agentfabric list	List Agent Fabric resources.	Extension	GA
az agentfabric member	Manage Agent Fabric members.	Extension	GA
az agentfabric member list	List members of an Agent Fabric.	Extension	GA
az agentfabric member show	Show an Agent Fabric member.	Extension	GA
az agentfabric member wait	Place the CLI in a waiting state until a condition is met.	Extension	GA
az agentfabric policy-group	Manage independent Agent Fabric Policy Groups.	Extension	GA
az agentfabric policy-group create	Create an independent Microsoft.NetworkSecurity Policy Group.	Extension	GA
az agentfabric policy-group delete	Delete an independent Policy Group.	Extension	GA
az agentfabric policy-group list	List independent Policy Groups.	Extension	GA
az agentfabric policy-group show	Show an independent Policy Group.	Extension	GA
az agentfabric policy-group update	Update an independent Policy Group's tags.	Extension	GA
az agentfabric policy-group wait	Place the CLI in a waiting state until a condition is met.	Extension	GA
az agentfabric show	Show an Agent Fabric resource.	Extension	GA
az agentfabric update	Update Agent Fabric tags or system-assigned identity.	Extension	GA
az agentfabric wait	Place the CLI in a waiting state until a condition is met.	Extension	GA

az agentfabric create

Create or replace an Agent Fabric resource.

Create an Agent Fabric, including its optional system-assigned identity and complete customer-owned content inspection endpoint/API-key pair. Omitting the inspection profile or supplying an empty object requests no connection change for an existing Fabric.

az agentfabric create --name
                      --resource-group
                      [--acquire-policy-token]
                      [--change-reference]
                      [--content-inspection-profile --inspection-profile]
                      [--default-policy-groups]
                      [--identity]
                      [--location]
                      [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                      [--tags]
                      [--trust-domain]

Examples

Create an Agent Fabric with customer-owned content inspection

az agentfabric create --resource-group rgnetworksecurity --name testAIFabric --location westus3 --trust-domain contoso.agentfabric --identity "{type:SystemAssigned}" --inspection-profile "{endpoint:'https://contoso.cognitiveservices.azure.com/',api-key:<content-safety-api-key>}"

Create an Agent Fabric without content inspection

az agentfabric create --resource-group rgnetworksecurity --name testAIFabric --location westus3 --trust-domain contoso.agentfabric

Required Parameters

--name -n

The name of the AgentFabric.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--content-inspection-profile --inspection-profile -p

The connection to the customer's Azure Content Safety account. For a new fabric created with API version 2026-10-07-preview or later, omitting this profile or supplying {} requests no inspection capability and uses no platform-owned account or shared-key fallback. For an existing fabric, omitting the profile from PUT, including requests from older clients, or supplying {} preserves its customer-owned connection, legacy regional connection, or absence of connection. The empty object is a request for no connection change, not a stored replacement profile. Neither omission nor {} removes, probes, or creates a connection or cancels a pending connection update. Other Fabric fields and policy compatibility rules still apply. A nonempty request profile requires both endpoint and apiKey, even at the unchanged endpoint. PUT can rotate the key or replace the endpoint by supplying the complete pair. Tags- or identity-only PATCH requests cannot change this profile. Existing legacy fabrics without a profile retain their regional Content Safety endpoint and authentication path. Omission or {} triggers no connection probe, account-management call, key retrieval, or credential requirement. Supplying a complete profile explicitly configures a customer-owned connection; there is no automatic conversion or failed-connection fallback to regional credentials. The customer owns, pays for, and operates the account. The service does not create, reserve, manage, or delete it. The service validates new or changed endpoint/credential configuration and the required Content Safety API before activation; configuration alone does not indicate readiness or active policy enforcement. Unchanged configuration, GET, and list do not trigger a new validation request. A failed replacement preserves the existing connection and credential, including a legacy regional connection. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--default-policy-groups

The default policy groups to apply to all members of this fabric. A fabric without a configured inspection connection cannot reference a group containing any ContentInspection policy, even when that policy's selectors currently match no traffic. For an existing fabric, compatibility uses the stored configuration when PUT omits contentInspectionProfile or supplies an empty object. Existing legacy fabrics retain their regional Content Safety connection, which satisfies the inspection prerequisite without new probes. A connection still being validated is not an absent connection. Removing a group reference remains allowed, subject to other validation. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--identity

The managed service identity assigned to this fabric. The service uses it to reach the clusters associated with the fabric on the customer's behalf. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Resource Arguments

--location -l

The geo-location where the resource lives When not specified, the location of the resource group will be used.

Property	Value
Parameter group:	Resource Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--tags

Resource tags. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Resource Arguments

--trust-domain

The trust domain that scopes this fabric's member identities. It is the leading component of each member's identity, which takes the form <trustDomain>/<agentFabricName>/<memberName>. Set at creation and immutable thereafter; when omitted, the shared default trust domain microsoft.agentfabric is used.

Property	Value
Parameter group:	Properties Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az agentfabric delete

Delete an Agent Fabric resource.

az agentfabric delete [--acquire-policy-token]
                      [--change-reference]
                      [--ids]
                      [--name]
                      [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                      [--resource-group]
                      [--subscription]
                      [--yes]

Examples

Delete an Agent Fabric

az agentfabric delete --resource-group rgnetworksecurity --name testAIFabric

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

The name of the AgentFabric.

Property	Value
Parameter group:	Resource Id Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az agentfabric list

List Agent Fabric resources.

az agentfabric list [--max-items]
                    [--next-token]
                    [--resource-group]

Examples

List Agent Fabrics in a resource group

az agentfabric list --resource-group rgnetworksecurity

List Agent Fabrics in a subscription

az agentfabric list

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property	Value
Parameter group:	Pagination Arguments

--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property	Value
Parameter group:	Pagination Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az agentfabric show

Show an Agent Fabric resource.

az agentfabric show [--ids]
                    [--name]
                    [--resource-group]
                    [--subscription]

Examples

Show an Agent Fabric

az agentfabric show --resource-group rgnetworksecurity --name testAIFabric

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

The name of the AgentFabric.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az agentfabric update

Update Agent Fabric tags or system-assigned identity.

Patch only tags and the system-assigned identity. Content inspection, trust domain, and default Policy Groups are not PATCH inputs.

az agentfabric update [--acquire-policy-token]
                      [--change-reference]
                      [--identity]
                      [--ids]
                      [--name]
                      [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                      [--resource-group]
                      [--subscription]
                      [--tags]

Examples

Update Agent Fabric tags and identity

az agentfabric update --resource-group rgnetworksecurity --name testAIFabric --tags "{env:prod}" --identity "{type:SystemAssigned}"

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--identity

The managed service identity assigned to this fabric. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

The name of the AgentFabric.

Property	Value
Parameter group:	Resource Id Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--tags

Resource tags. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az agentfabric wait

Place the CLI in a waiting state until a condition is met.

az agentfabric wait [--acquire-policy-token]
                    [--change-reference]
                    [--created]
                    [--custom]
                    [--deleted]
                    [--exists]
                    [--ids]
                    [--interval]
                    [--name]
                    [--resource-group]
                    [--subscription]
                    [--timeout]
                    [--updated]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--created

Wait until created with 'provisioningState' at 'Succeeded'.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

--custom

Wait until the condition satisfies a custom JMESPath query. E.g. provisioningState!='InProgress', instanceView.statuses[?code=='PowerState/running'].

Property	Value
Parameter group:	Wait Condition Arguments

--deleted

Wait until deleted.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

--exists

Wait until the resource exists.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--interval

Polling interval in seconds.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	30

--name -n

The name of the AgentFabric.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--timeout

Maximum wait in seconds.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	3600

--updated

Wait until updated with provisioningState at 'Succeeded'.

Property	Value
Parameter group:	Wait Condition Arguments
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False