Security Policies Interface - Update

Service:

Application Gateway for Containers

API Version:

2026-03-01

Update a SecurityPolicy

PATCH https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ServiceNetworking/trafficControllers/{trafficControllerName}/securityPolicies/{securityPolicyName}?api-version=2026-03-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
securityPolicyName	path	True	string pattern: ^[A-Za-z0-9]([A-Za-z0-9-_.]{0,62}[A-Za-z0-9])?$	SecurityPolicy
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
trafficControllerName	path	True	string pattern: ^[A-Za-z0-9]([A-Za-z0-9-_.]{0,62}[A-Za-z0-9])?$	traffic controller name for path
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Type	Description
properties.ipAccessRulesPolicy	IpAccessRulesPolicy	Ip Access Policy of the Traffic Controller Security Policy. Single Security Policy can have only one policy type set.
properties.wafPolicy	WafPolicyUpdate	Web Application Firewall Policy of the Traffic Controller Security Policy. Single Security Policy can have only one policy type set.
tags	object	Resource tags.

Responses

Name	Type	Description
200 OK	SecurityPolicy	Azure operation completed successfully.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Update IpAccessRules SecurityPolicy

Update WAF SecurityPolicy

Update IpAccessRules SecurityPolicy

Sample request

HTTP

PATCH https://management.azure.com/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ServiceNetworking/trafficControllers/tc1/securityPolicies/sp1?api-version=2026-03-01

{
  "properties": {
    "ipAccessRulesPolicy": {
      "rules": []
    }
  }
}

Python

from azure.identity import DefaultAzureCredential

from azure.mgmt.servicenetworking import ServiceNetworkingMgmtClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-servicenetworking
# USAGE
    python ip_access_rules_security_policy_patch.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = ServiceNetworkingMgmtClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.security_policies_interface.update(
        resource_group_name="rg1",
        traffic_controller_name="tc1",
        security_policy_name="sp1",
        properties={"properties": {"ipAccessRulesPolicy": {"rules": []}}},
    )
    print(response)


# x-ms-original-file: 2026-03-01/IpAccessRulesSecurityPolicyPatch.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armservicenetworking_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/servicenetworking/armservicenetworking"
)

// Generated from example definition: 2026-03-01/IpAccessRulesSecurityPolicyPatch.json
func ExampleSecurityPoliciesInterfaceClient_Update_updateIPAccessRulesSecurityPolicy() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armservicenetworking.NewClientFactory("subid", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewSecurityPoliciesInterfaceClient().Update(ctx, "rg1", "tc1", "sp1", armservicenetworking.SecurityPolicyUpdate{
		Properties: &armservicenetworking.SecurityPolicyUpdateProperties{
			IPAccessRulesPolicy: &armservicenetworking.IPAccessRulesPolicy{
				Rules: []*armservicenetworking.IPAccessRule{},
			},
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armservicenetworking.SecurityPoliciesInterfaceClientUpdateResponse{
	// 	SecurityPolicy: armservicenetworking.SecurityPolicy{
	// 		Name: to.Ptr("ipAccessRules-0"),
	// 		Type: to.Ptr("Microsoft.ServiceNetworking/trafficControllers/securityPolicies"),
	// 		ID: to.Ptr("/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.ServiceNetworking/trafficControllers/sample-tc/securityPolicies/ipAccessRules-0"),
	// 		Location: to.Ptr("NorthCentralUS"),
	// 		Properties: &armservicenetworking.SecurityPolicyProperties{
	// 			PolicyType: to.Ptr(armservicenetworking.PolicyTypeIPAccessRules),
	// 			IPAccessRulesPolicy: &armservicenetworking.IPAccessRulesPolicy{
	// 				Rules: []*armservicenetworking.IPAccessRule{
	// 				},
	// 			},
	// 			ProvisioningState: to.Ptr(armservicenetworking.ProvisioningStateSucceeded),
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { ServiceNetworkingManagementClient } = require("@azure/arm-servicenetworking");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to update a SecurityPolicy
 *
 * @summary update a SecurityPolicy
 * x-ms-original-file: 2026-03-01/IpAccessRulesSecurityPolicyPatch.json
 */
async function updateIpAccessRulesSecurityPolicy() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "subid";
  const client = new ServiceNetworkingManagementClient(credential, subscriptionId);
  const result = await client.securityPoliciesInterface.update("rg1", "tc1", "sp1", {
    properties: { ipAccessRulesPolicy: { rules: [] } },
  });
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

{
  "name": "ipAccessRules-0",
  "type": "Microsoft.ServiceNetworking/trafficControllers/securityPolicies",
  "id": "/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.ServiceNetworking/trafficControllers/sample-tc/securityPolicies/ipAccessRules-0",
  "location": "NorthCentralUS",
  "properties": {
    "policyType": "ipAccessRules",
    "ipAccessRulesPolicy": {
      "rules": []
    },
    "provisioningState": "Succeeded"
  }
}

Update WAF SecurityPolicy

Sample request

HTTP

PATCH https://management.azure.com/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ServiceNetworking/trafficControllers/tc1/securityPolicies/sp1?api-version=2026-03-01

{
  "properties": {
    "wafPolicy": {
      "id": "/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/wp-0"
    }
  }
}

Python

from azure.identity import DefaultAzureCredential

from azure.mgmt.servicenetworking import ServiceNetworkingMgmtClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-servicenetworking
# USAGE
    python waf_security_policy_patch.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = ServiceNetworkingMgmtClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.security_policies_interface.update(
        resource_group_name="rg1",
        traffic_controller_name="tc1",
        security_policy_name="sp1",
        properties={
            "properties": {
                "wafPolicy": {
                    "id": "/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/wp-0"
                }
            }
        },
    )
    print(response)


# x-ms-original-file: 2026-03-01/WafSecurityPolicyPatch.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armservicenetworking_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/servicenetworking/armservicenetworking"
)

// Generated from example definition: 2026-03-01/WafSecurityPolicyPatch.json
func ExampleSecurityPoliciesInterfaceClient_Update_updateWafSecurityPolicy() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armservicenetworking.NewClientFactory("subid", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewSecurityPoliciesInterfaceClient().Update(ctx, "rg1", "tc1", "sp1", armservicenetworking.SecurityPolicyUpdate{
		Properties: &armservicenetworking.SecurityPolicyUpdateProperties{
			WafPolicy: &armservicenetworking.WafPolicy{
				ID: to.Ptr("/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/wp-0"),
			},
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armservicenetworking.SecurityPoliciesInterfaceClientUpdateResponse{
	// 	SecurityPolicy: armservicenetworking.SecurityPolicy{
	// 		Name: to.Ptr("waf-0"),
	// 		Type: to.Ptr("Microsoft.ServiceNetworking/trafficControllers/securityPolicies"),
	// 		ID: to.Ptr("/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.ServiceNetworking/trafficControllers/sample-tc/securityPolicies/waf-0"),
	// 		Location: to.Ptr("NorthCentralUS"),
	// 		Properties: &armservicenetworking.SecurityPolicyProperties{
	// 			PolicyType: to.Ptr(armservicenetworking.PolicyTypeWAF),
	// 			WafPolicy: &armservicenetworking.WafPolicy{
	// 				ID: to.Ptr("/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/wp-0"),
	// 			},
	// 			ProvisioningState: to.Ptr(armservicenetworking.ProvisioningStateSucceeded),
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { ServiceNetworkingManagementClient } = require("@azure/arm-servicenetworking");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to update a SecurityPolicy
 *
 * @summary update a SecurityPolicy
 * x-ms-original-file: 2026-03-01/WafSecurityPolicyPatch.json
 */
async function updateWAFSecurityPolicy() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "subid";
  const client = new ServiceNetworkingManagementClient(credential, subscriptionId);
  const result = await client.securityPoliciesInterface.update("rg1", "tc1", "sp1", {
    properties: {
      wafPolicy: {
        id: "/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/wp-0",
      },
    },
  });
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

{
  "name": "waf-0",
  "type": "Microsoft.ServiceNetworking/trafficControllers/securityPolicies",
  "id": "/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.ServiceNetworking/trafficControllers/sample-tc/securityPolicies/waf-0",
  "location": "NorthCentralUS",
  "properties": {
    "policyType": "waf",
    "wafPolicy": {
      "id": "/subscriptions/subid/resourcegroups/rg1/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/wp-0"
    },
    "provisioningState": "Succeeded"
  }
}

Definitions

Name	Description
createdByType	The type of identity that created the resource.
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
IpAccessRule	Ip Access Policy Rules
IpAccessRuleAction	Action of Ip Access Rule
IpAccessRulesPolicy	Ip Access Policy
PolicyType	Policy Type of the Security Policy
ProvisioningState	Resource Provisioning State Enum
SecurityPolicy	SecurityPolicy Subresource of Traffic Controller.
SecurityPolicyUpdate	The type used for update operations of the SecurityPolicy.
systemData	Metadata pertaining to creation and last modification of the resource.
WafPolicy	Web Application Firewall Policy
WafPolicyUpdate	Web Application Firewall Policy

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Object

Error response

Name	Type	Description
error	ErrorDetail	The error object.

IpAccessRule

Object

Ip Access Policy Rules

Name	Type	Description
action	IpAccessRuleAction	Action of the Rule
name	string	Name of the Ip Access Rule
priority	integer (int32) minimum: 1 maximum: 500	The priority of the rule. The value can be between 1 and 500. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule.
sourceAddressPrefixes	string[]	Source Address Prefixed Applied by the Rule. Asterisk '*' can also be used to match all source IPs.

IpAccessRuleAction

Enumeration

Action of Ip Access Rule

Value	Description
allow	Allow Source Ip Prefixes
deny	Deny Source Ip Prefixes

IpAccessRulesPolicy

Object

Ip Access Policy

Name	Type	Description
rules	IpAccessRule[]	Ip Access Policy Rules List

PolicyType

Enumeration

Policy Type of the Security Policy

Value	Description
waf	Policy of Type WAF
ipAccessRules	Policy of Type IpAccessRules

ProvisioningState

Enumeration

Resource Provisioning State Enum

Value	Description
Provisioning	Resource in Provisioning State
Updating	Resource in Updating State
Deleting	Resource in Deleting State
Accepted	Resource in Accepted State
Succeeded	Resource in Succeeded State
Failed	Resource in Failed State
Canceled	Resource in Canceled State

SecurityPolicy

Object

SecurityPolicy Subresource of Traffic Controller.

Name	Type	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
location	string	The geo-location where the resource lives
name	string	The name of the resource
properties.ipAccessRulesPolicy	IpAccessRulesPolicy	Ip Access Policy of the Traffic Controller Security Policy. Single Security Policy can have only one policy type set.
properties.policyType	PolicyType	Type of the Traffic Controller Security Policy
properties.provisioningState	ProvisioningState	Provisioning State of Traffic Controller SecurityPolicy Resource
properties.wafPolicy	WafPolicy	Web Application Firewall Policy of the Traffic Controller Security Policy. Single Security Policy can have only one policy type set.
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

SecurityPolicyUpdate

Object

The type used for update operations of the SecurityPolicy.

Name	Type	Description
properties.ipAccessRulesPolicy	IpAccessRulesPolicy	Ip Access Policy of the Traffic Controller Security Policy. Single Security Policy can have only one policy type set.
properties.wafPolicy	WafPolicyUpdate	Web Application Firewall Policy of the Traffic Controller Security Policy. Single Security Policy can have only one policy type set.
tags	object	Resource tags.

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

WafPolicy

Object

Web Application Firewall Policy

Name	Type	Description
id	string	Resource ID of the WAF

WafPolicyUpdate

Object

Web Application Firewall Policy

Name	Type	Description
id	string	Resource ID of the WAF