Cannot persist change from Set-AzNetworkSecurityRuleConfig

spaelling commented 5 years ago

Description

Set-AzNetworkSecurityRuleConfig does not produce an output that can be piped to Set-AzNetworkSecurityGroup so that the change can be persisted.

If the changes made cannot be persisted, then I am not sure what the purpose of the cmdlet is.

Script/Steps for Reproduction

Below is using the example from the official docs but piping $nsg to Set-AzNetworkSecurityGroup which then fails.

$nsg = Get-AzNetworkSecurityGroup -Name "NSG-FrontEnd" -ResourceGroupName "TestRG"
$nsg | Get-AzNetworkSecurityRuleConfig -Name "rdp-rule" | Format-Table -AutoSize
<# OUTPUT
Description Protocol SourcePortRange DestinationPortRange SourceAddressPrefix DestinationAddressPrefix Access Priority Direction ProvisioningState
----------- -------- --------------- -------------------- ------------------- ------------------------ ------ -------- --------- -----------------
            *        {*}             {3389}               {*}                 {*}                      Allow       100 Inbound   Succeeded
#>
Set-AzNetworkSecurityRuleConfig -Name "rdp-rule" -NetworkSecurityGroup $nsg -Access "Deny" | Out-Null
$nsg | Get-AzNetworkSecurityRuleConfig -Name "rdp-rule" | Format-Table -AutoSize
<# OUTPUT
Description Protocol SourcePortRange DestinationPortRange SourceAddressPrefix DestinationAddressPrefix Access Priority Direction ProvisioningState
----------- -------- --------------- -------------------- ------------------- ------------------------ ------ -------- --------- -----------------
                                                                                                       Deny          0           Succeeded
#>
# if we want to persist then it will fail. Set-AzNetworkSecurityRuleConfig ignored existing properties on the rule, and we cannot commit the rule
$nsg | Set-AzNetworkSecurityGroup
<# OUTPUT
Set-AzNetworkSecurityGroup : Required security rule parameter Protocol is missing for security rule with Id:
/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/securityRules/rdp-rule.
StatusCode: 400
ReasonPhrase: Bad Request
OperationID : 'd56fe00f-9e73-4e3d-86e7-08c1e5fa6f93'
#>

# we can do it "manually"
$nsg = Get-AzNetworkSecurityGroup -Name "NSG-FrontEnd" -ResourceGroupName "TestRG"
($nsg.SecurityRules | Where-Object {$_.Name -eq 'rdp-rule'}).Access = 'Deny'
# updating NSG works fine now
$nsg | Set-AzNetworkSecurityGroup | Get-AzNetworkSecurityRuleConfig -Name "rdp-rule" | Format-Table -AutoSize
<# OUTPUT
Description Protocol SourcePortRange DestinationPortRange SourceAddressPrefix DestinationAddressPrefix Access Priority Direction ProvisioningState
----------- -------- --------------- -------------------- ------------------- ------------------------ ------ -------- --------- -----------------
            *        {*}             {3389}               {*}                 {*}                      Deny        100 Inbound   Succeeded
#>

Module Version

Get-Module -ListAvailable

    Directory: E:\OneDrive\Dokumenter\WindowsPowerShell\Modules

ModuleType Version    Name                                ExportedCommands                                                                                                                                                                
---------- -------    ----                                ----------------                                                                                                                                                                
Script     5.4.2      InvokeBuild                         {Invoke-Build, Build-Checkpoint, Build-Parallel}                                                                                                                                

    Directory: C:\Program Files\WindowsPowerShell\Modules

ModuleType Version    Name                                ExportedCommands                                                                                                                                                                
---------- -------    ----                                ----------------                                                                                                                                                                
Script     1.1.0      Az.Accounts                         {Disable-AzDataCollection, Disable-AzContextAutosave, Enable-AzDataCollection, Enable-AzContextAutosave...}                                                                     
Script     1.0.0      Az.Accounts                         {Disable-AzDataCollection, Disable-AzContextAutosave, Enable-AzDataCollection, Enable-AzContextAutosave...}                                                                     
Script     1.0.0      Az.Aks                              {Get-AzAks, New-AzAks, Remove-AzAks, Import-AzAksCredential...}                                                                                                                 
Script     1.0.0      Az.AnalysisServices                 {Resume-AzAnalysisServicesServer, Suspend-AzAnalysisServicesServer, Get-AzAnalysisServicesServer, Remove-AzAnalysisServicesServer...}                                           
Script     1.0.0      Az.ApiManagement                    {Add-AzApiManagementRegion, Get-AzApiManagementSsoToken, New-AzApiManagementCustomHostnameConfiguration, New-AzApiManagementSystemCertificate...}                               
Script     1.0.0      Az.ApplicationInsights              {Get-AzApplicationInsights, New-AzApplicationInsights, Remove-AzApplicationInsights, Set-AzApplicationInsightsPricingPlan...}                                                   
Script     1.0.0      Az.Automation                       {Get-AzAutomationHybridWorkerGroup, Remove-AzAutomationHybridWorkerGroup, Get-AzAutomationJobOutputRecord, Import-AzAutomationDscNodeConfiguration...}                          
Script     1.0.0      Az.Batch                            {Remove-AzBatchAccount, Get-AzBatchAccount, Get-AzBatchAccountKeys, New-AzBatchAccount...}                                                                                      
Script     1.0.0      Az.Billing                          {Get-AzBillingInvoice, Get-AzBillingPeriod, Get-AzEnrollmentAccount, Get-AzConsumptionBudget...}                                                                                
Script     1.0.0      Az.Cdn                              {Get-AzCdnProfile, Get-AzCdnProfileSsoUrl, New-AzCdnProfile, Remove-AzCdnProfile...}                                                                                            
Script     1.0.0      Az.CognitiveServices                {Get-AzCognitiveServicesAccount, Get-AzCognitiveServicesAccountKey, Get-AzCognitiveServicesAccountSkus, Get-AzCognitiveServicesAccountType...}                                  
Script     1.1.0      Az.Compute                          {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAvailabilitySet, Update-AzAvailabilitySet...}                                                                           
Script     1.0.0      Az.Compute                          {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAvailabilitySet, Update-AzAvailabilitySet...}                                                                           
Script     1.0.0      Az.ContainerInstance                {New-AzContainerGroup, Get-AzContainerGroup, Remove-AzContainerGroup, Get-AzContainerInstanceLog}                                                                               
Script     1.0.0      Az.ContainerRegistry                {New-AzContainerRegistry, Get-AzContainerRegistry, Update-AzContainerRegistry, Remove-AzContainerRegistry...}                                                                   
Script     1.0.0      Az.DataFactory                      {Set-AzDataFactoryV2, Update-AzDataFactoryV2, Get-AzDataFactoryV2, Remove-AzDataFactoryV2...}                                                                                   
Script     1.0.0      Az.DataLakeAnalytics                {Get-AzDataLakeAnalyticsDataSource, New-AzDataLakeAnalyticsCatalogCredential, Remove-AzDataLakeAnalyticsCatalogCredential, Set-AzDataLakeAnalyticsCatalogCredential...}         
Script     1.0.1      Az.DataLakeStore                    {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeStoreFirewallRule, Set-AzDataLakeStoreTrustedIdProvider...}                    
Script     1.0.0      Az.DataLakeStore                    {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeStoreFirewallRule, Set-AzDataLakeStoreTrustedIdProvider...}                    
Script     1.0.0      Az.DevTestLabs                      {Get-AzDtlAllowedVMSizesPolicy, Get-AzDtlAutoShutdownPolicy, Get-AzDtlAutoStartPolicy, Get-AzDtlVMsPerLabPolicy...}                                                             
Script     1.0.0      Az.Dns                              {Get-AzDnsRecordSet, New-AzDnsRecordConfig, Remove-AzDnsRecordSet, Set-AzDnsRecordSet...}                                                                                       
Script     1.1.0      Az.EventGrid                        {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGridTopic, New-AzEventGridTopicKey...}                                                                                  
Script     1.0.0      Az.EventGrid                        {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGridTopic, New-AzEventGridTopicKey...}                                                                                  
Script     1.0.0      Az.EventHub                         {New-AzEventHubNamespace, Get-AzEventHubNamespace, Set-AzEventHubNamespace, Remove-AzEventHubNamespace...}                                                                      
Script     1.0.0      Az.HDInsight                        {Get-AzHDInsightJob, New-AzHDInsightSqoopJobDefinition, Wait-AzHDInsightJob, New-AzHDInsightStreamingMapReduceJobDefinition...}                                                 
Script     1.0.1      Az.IotHub                           {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-AzIotHubConnectionString, Get-AzIotHubJob...}                                                                          
Script     1.0.0      Az.IotHub                           {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-AzIotHubConnectionString, Get-AzIotHubJob...}                                                                          
Script     1.0.0      Az.KeyVault                         {Add-AzKeyVaultCertificate, Update-AzKeyVaultCertificate, Stop-AzKeyVaultCertificateOperation, Get-AzKeyVaultCertificateOperation...}                                           
Script     1.1.0      Az.LogicApp                         {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccountCallbackUrl, Get-AzIntegrationAccountCertificate, Get-AzIntegrationAccount...}                                      
Script     1.0.0      Az.LogicApp                         {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccountCallbackUrl, Get-AzIntegrationAccountCertificate, Get-AzIntegrationAccount...}                                      
Script     1.0.0      Az.MachineLearning                  {Move-AzMlCommitmentAssociation, Get-AzMlCommitmentAssociation, Get-AzMlCommitmentPlanUsageHistory, Remove-AzMlCommitmentPlan...}                                               
Script     1.0.0      Az.MarketplaceOrdering              {Get-AzMarketplaceTerms, Set-AzMarketplaceTerms}                                                                                                                                
Script     1.0.0      Az.Media                            {Sync-AzMediaServiceStorageKeys, Set-AzMediaServiceKey, Get-AzMediaServiceKeys, Get-AzMediaServiceNameAvailability...}                                                          
Script     1.0.0      Az.Monitor                          {Get-AzMetricDefinition, Get-AzMetric, Remove-AzLogProfile, Get-AzLogProfile...}                                                                                                
Script     1.0.0      Az.Network                          {Add-AzApplicationGatewayAuthenticationCertificate, Get-AzApplicationGatewayAuthenticationCertificate, New-AzApplicationGatewayAuthenticationCertificate, Remove-AzApplicatio...
Script     1.0.0      Az.NotificationHubs                 {Get-AzNotificationHub, Get-AzNotificationHubAuthorizationRules, Get-AzNotificationHubListKeys, Get-AzNotificationHubPNSCredentials...}                                         
Script     1.0.0      Az.OperationalInsights              {New-AzOperationalInsightsAzureActivityLogDataSource, New-AzOperationalInsightsCustomLogDataSource, Disable-AzOperationalInsightsLinuxCustomLogCollection, Disable-AzOperatio...
Script     1.0.0      Az.PolicyInsights                   {Get-AzPolicyEvent, Get-AzPolicyState, Get-AzPolicyStateSummary, Get-AzPolicyRemediation...}                                                                                    
Script     1.0.0      Az.PowerBIEmbedded                  {Remove-AzPowerBIWorkspaceCollection, Get-AzPowerBIWorkspaceCollection, Get-AzPowerBIWorkspaceCollectionAccessKeys, Get-AzPowerBIWorkspace...}                                  
Script     1.0.0      Az.RecoveryServices                 {Get-AzRecoveryServicesBackupProperty, Get-AzRecoveryServicesVault, Get-AzRecoveryServicesVaultSettingsFile, New-AzRecoveryServicesVault...}                                    
Script     1.0.0      Az.RedisCache                       {Remove-AzRedisCachePatchSchedule, New-AzRedisCacheScheduleEntry, Get-AzRedisCachePatchSchedule, New-AzRedisCachePatchSchedule...}                                              
Script     1.0.0      Az.Relay                            {New-AzRelayNamespace, Get-AzRelayNamespace, Set-AzRelayNamespace, Remove-AzRelayNamespace...}                                                                                  
Script     0.7.1      Az.ResourceGraph                    Search-AzGraph                                                                                                                                                                  
Script     1.1.0      Az.Resources                        {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzRoleAssignment, New-AzRoleAssignment...}                                                                               
Script     1.0.0      Az.Resources                        {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzRoleAssignment, New-AzRoleAssignment...}                                                                               
Script     1.0.0      Az.ServiceBus                       {New-AzServiceBusNamespace, Get-AzServiceBusNamespace, Set-AzServiceBusNamespace, Remove-AzServiceBusNamespace...}                                                              
Script     1.0.0      Az.ServiceFabric                    {Add-AzServiceFabricApplicationCertificate, Add-AzServiceFabricClientCertificate, Add-AzServiceFabricClusterCertificate, Add-AzServiceFabricNode...}                            
Script     1.0.1      Az.SignalR                          {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSignalRKey...}                                                                                                           
Script     1.0.0      Az.SignalR                          {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSignalRKey...}                                                                                                           
Script     1.0.1      Az.Sql                              {Get-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlDatabaseTransparentDataEncryptionActivity, Set-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlDatabaseUpgradeHint...}   
Script     1.0.0      Az.Sql                              {Get-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlDatabaseTransparentDataEncryptionActivity, Set-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlDatabaseUpgradeHint...}   
Script     1.0.1      Az.Storage                          {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStorageAccount, New-AzStorageAccountKey...}                                                                               
Script     1.0.0      Az.Storage                          {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStorageAccount, New-AzStorageAccountKey...}                                                                               
Script     1.0.0      Az.StreamAnalytics                  {Get-AzStreamAnalyticsFunction, Get-AzStreamAnalyticsDefaultFunctionDefinition, New-AzStreamAnalyticsFunction, Remove-AzStreamAnalyticsFunction...}                             
Script     1.0.0      Az.TrafficManager                   {Add-AzTrafficManagerCustomHeaderToEndpoint, Remove-AzTrafficManagerCustomHeaderFromEndpoint, Add-AzTrafficManagerCustomHeaderToProfile, Remove-AzTrafficManagerCustomHeaderF...
Script     1.0.1      Az.Websites                         {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServicePlan, Remove-AzAppServicePlan...}                                                                                  
Script     1.0.0      Az.Websites                         {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServicePlan, Remove-AzAppServicePlan...}                                                                                  
Script     1.0.1      Microsoft.PowerShell.Operation.V... {Get-OperationValidation, Invoke-OperationValidation}                                                                                                                           
Binary     1.0.0.1    PackageManagement                   {Find-Package, Get-Package, Get-PackageProvider, Get-PackageSource...}                                                                                                          
Script     3.4.0      Pester                              {Describe, Context, It, Should...}                                                                                                                                              
Script     0.2.0      Polaris                             {Get-Polaris, Clear-Polaris, New-PolarisRoute, Remove-PolarisRoute...}                                                                                                          
Script     1.0.0.1    PowerShellGet                       {Install-Module, Find-Module, Save-Module, Update-Module...}                                                                                                                    
Script     0.7.1      PSHTML                              {nav, New-PSHTMLChartPieDataSet, small, Get-PSHTMLConfiguration...}                                                                                                             
Script     1.2        PSReadline                          {Get-PSReadlineKeyHandler, Set-PSReadlineKeyHandler, Remove-PSReadlineKeyHandler, Get-PSReadlineOption...}                                                                      
Script     0.0.46     PSSharedGoods                       {Add-WinADUserGroups, Get-WinADForestControllers, Get-WinADOrganizationalUnitData, Get-WinADOrganizationalUnitFromDN...}                                                        
Script     0.83       PSWriteColor                        {Write-Color, Write-ColorDev}                                                                                                                                                   
Script     0.0.0.2    ReportHTMLHelpers                   {Get-HostUptime, Test-AzureRMAccountTokenExpiry, Connect-AzureRunAsConnection}                                                                                                  

    Directory: C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules

ModuleType Version    Name                                ExportedCommands                                                                                                                                                                
---------- -------    ----                                ----------------                                                                                                                                                                
Manifest   1.0.0.0    AppBackgroundTask                   {Disable-AppBackgroundTaskDiagnosticLog, Enable-AppBackgroundTaskDiagnosticLog, Set-AppBackgroundTaskResourcePolicy, Unregister-AppBackgroundTask...}                           
Manifest   2.0.0.0    Appx                                {Add-AppxPackage, Get-AppxPackage, Get-AppxPackageManifest, Remove-AppxPackage...}                                                                                              
Manifest   1.0.0.0    BitLocker                           {Unlock-BitLocker, Suspend-BitLocker, Resume-BitLocker, Remove-BitLockerKeyProtector...}                                                                                        
Manifest   2.0.0.0    BitsTransfer                        {Add-BitsFile, Complete-BitsTransfer, Get-BitsTransfer, Remove-BitsTransfer...}                                                                                                 
Manifest   1.0.0.0    CimCmdlets                          {Get-CimAssociatedInstance, Get-CimClass, Get-CimInstance, Get-CimSession...}                                                                                                   
Manifest   1.0        Defender                            {Get-MpPreference, Set-MpPreference, Add-MpPreference, Remove-MpPreference...}                                                                                                  
Manifest   1.0.0.0    DeliveryOptimization                {Get-DeliveryOptimizationStatus, Get-DeliveryOptimizationPerfSnap, Get-DeliveryOptimizationLog, Get-DODownloadMode...}                                                          
Manifest   1.0.0.0    DirectAccessClientComponents        {Disable-DAManualEntryPointSelection, Enable-DAManualEntryPointSelection, Get-DAClientExperienceConfiguration, Get-DAEntryPointTableItem...}                                    
Script     3.0        Dism                                {Add-AppxProvisionedPackage, Add-WindowsDriver, Add-WindowsCapability, Add-WindowsImage...}                                                                                     
Manifest   1.0.0.0    DnsClient                           {Resolve-DnsName, Clear-DnsClientCache, Get-DnsClient, Get-DnsClientCache...}                                                                                                   
Manifest   1.0.0.0    EventTracingManagement              {Start-EtwTraceSession, New-EtwTraceSession, Get-EtwTraceSession, Update-EtwTraceSession...}                                                                                    
Manifest   2.0.0.0    International                       {Get-WinDefaultInputMethodOverride, Set-WinDefaultInputMethodOverride, Get-WinHomeLocation, Set-WinHomeLocation...}                                                             
Manifest   1.0.0.0    iSCSI                               {Get-IscsiTargetPortal, New-IscsiTargetPortal, Remove-IscsiTargetPortal, Update-IscsiTargetPortal...}                                                                           
Script     1.0.0.0    ISE                                 {New-IseSnippet, Import-IseSnippet, Get-IseSnippet}                                                                                                                             
Manifest   1.0.0.0    Kds                                 {Add-KdsRootKey, Get-KdsRootKey, Test-KdsRootKey, Set-KdsConfiguration...}                                                                                                      
Manifest   1.0.1.0    Microsoft.PowerShell.Archive        {Compress-Archive, Expand-Archive}                                                                                                                                              
Manifest   3.0.0.0    Microsoft.PowerShell.Diagnostics    {Get-WinEvent, Get-Counter, Import-Counter, Export-Counter...}                                                                                                                  
Manifest   3.0.0.0    Microsoft.PowerShell.Host           {Start-Transcript, Stop-Transcript}                                                                                                                                             
Manifest   1.0.0.0    Microsoft.PowerShell.LocalAccounts  {Add-LocalGroupMember, Disable-LocalUser, Enable-LocalUser, Get-LocalGroup...}                                                                                                  
Manifest   3.1.0.0    Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-ItemProperty, Join-Path...}                                                                                                                  
Script     1.0        Microsoft.PowerShell.ODataUtils     Export-ODataEndpointProxy                                                                                                                                                       
Manifest   3.0.0.0    Microsoft.PowerShell.Security       {Get-Acl, Set-Acl, Get-PfxCertificate, Get-Credential...}                                                                                                                       
Manifest   3.1.0.0    Microsoft.PowerShell.Utility        {Format-List, Format-Custom, Format-Table, Format-Wide...}                                                                                                                      
Manifest   3.0.0.0    Microsoft.WSMan.Management          {Disable-WSManCredSSP, Enable-WSManCredSSP, Get-WSManCredSSP, Set-WSManQuickConfig...}                                                                                          
Manifest   1.0        MMAgent                             {Disable-MMAgent, Enable-MMAgent, Set-MMAgent, Get-MMAgent...}                                                                                                                  
Manifest   1.0.0.0    MsDtc                               {New-DtcDiagnosticTransaction, Complete-DtcDiagnosticTransaction, Join-DtcDiagnosticResourceManager, Receive-DtcDiagnosticTransaction...}                                       
Manifest   2.0.0.0    NetAdapter                          {Disable-NetAdapter, Disable-NetAdapterBinding, Disable-NetAdapterChecksumOffload, Disable-NetAdapterEncapsulatedPacketTaskOffload...}                                          
Manifest   1.0.0.0    NetConnection                       {Get-NetConnectionProfile, Set-NetConnectionProfile}                                                                                                                            
Manifest   1.0.0.0    NetDiagnostics                      Get-NetView                                                                                                                                                                     
Manifest   1.0.0.0    NetEventPacketCapture               {New-NetEventSession, Remove-NetEventSession, Get-NetEventSession, Set-NetEventSession...}                                                                                      
Manifest   2.0.0.0    NetLbfo                             {Add-NetLbfoTeamMember, Add-NetLbfoTeamNic, Get-NetLbfoTeam, Get-NetLbfoTeamMember...}                                                                                          
Manifest   1.0.0.0    NetNat                              {Get-NetNat, Get-NetNatExternalAddress, Get-NetNatStaticMapping, Get-NetNatSession...}                                                                                          
Manifest   2.0.0.0    NetQos                              {Get-NetQosPolicy, Set-NetQosPolicy, Remove-NetQosPolicy, New-NetQosPolicy}                                                                                                     
Manifest   2.0.0.0    NetSecurity                         {Get-DAPolicyChange, New-NetIPsecAuthProposal, New-NetIPsecMainModeCryptoProposal, New-NetIPsecQuickModeCryptoProposal...}                                                      
Manifest   1.0.0.0    NetSwitchTeam                       {New-NetSwitchTeam, Remove-NetSwitchTeam, Get-NetSwitchTeam, Rename-NetSwitchTeam...}                                                                                           
Manifest   1.0.0.0    NetTCPIP                            {Get-NetIPAddress, Get-NetIPInterface, Get-NetIPv4Protocol, Get-NetIPv6Protocol...}                                                                                             
Manifest   1.0.0.0    NetworkConnectivityStatus           {Get-DAConnectionStatus, Get-NCSIPolicyConfiguration, Reset-NCSIPolicyConfiguration, Set-NCSIPolicyConfiguration}                                                               
Manifest   1.0.0.0    NetworkSwitchManager                {Disable-NetworkSwitchEthernetPort, Enable-NetworkSwitchEthernetPort, Get-NetworkSwitchEthernetPort, Remove-NetworkSwitchEthernetPortIPAddress...}                              
Manifest   1.0.0.0    NetworkTransition                   {Add-NetIPHttpsCertBinding, Disable-NetDnsTransitionConfiguration, Disable-NetIPHttpsProfile, Disable-NetNatTransitionConfiguration...}                                         
Manifest   1.0.0.0    PcsvDevice                          {Get-PcsvDevice, Start-PcsvDevice, Stop-PcsvDevice, Restart-PcsvDevice...}                                                                                                      
Binary     1.0.0.0    PersistentMemory                    {Get-PmemDisk, Get-PmemPhysicalDevice, Get-PmemUnusedRegion, New-PmemDisk...}                                                                                                   
Manifest   1.0.0.0    PKI                                 {Add-CertificateEnrollmentPolicyServer, Export-Certificate, Export-PfxCertificate, Get-CertificateAutoEnrollmentPolicy...}                                                      
Manifest   1.0.0.0    PnpDevice                           {Get-PnpDevice, Get-PnpDeviceProperty, Enable-PnpDevice, Disable-PnpDevice}                                                                                                     
Manifest   1.1        PrintManagement                     {Add-Printer, Add-PrinterDriver, Add-PrinterPort, Get-PrintConfiguration...}                                                                                                    
Binary     1.0.11     ProcessMitigations                  {Get-ProcessMitigation, Set-ProcessMitigation, ConvertTo-ProcessMitigationPolicy}                                                                                               
Script     3.0        Provisioning                        {Install-ProvisioningPackage, Export-ProvisioningPackage, Install-TrustedProvisioningCertificate, Export-Trace...}                                                              
Manifest   1.1        PSDesiredStateConfiguration         {Set-DscLocalConfigurationManager, Start-DscConfiguration, Test-DscConfiguration, Publish-DscConfiguration...}                                                                  
Script     1.0.0.0    PSDiagnostics                       {Disable-PSTrace, Disable-PSWSManCombinedTrace, Disable-WSManTrace, Enable-PSTrace...}                                                                                          
Binary     1.1.0.0    PSScheduledJob                      {New-JobTrigger, Add-JobTrigger, Remove-JobTrigger, Get-JobTrigger...}                                                                                                          
Manifest   2.0.0.0    PSWorkflow                          {New-PSWorkflowExecutionOption, New-PSWorkflowSession, nwsn}                                                                                                                    
Manifest   1.0.0.0    PSWorkflowUtility                   Invoke-AsWorkflow                                                                                                                                                               
Manifest   1.0.0.0    ScheduledTasks                      {Get-ScheduledTask, Set-ScheduledTask, Register-ScheduledTask, Unregister-ScheduledTask...}                                                                                     
Manifest   2.0.0.0    SecureBoot                          {Confirm-SecureBootUEFI, Set-SecureBootUEFI, Get-SecureBootUEFI, Format-SecureBootUEFI...}                                                                                      
Manifest   2.0.0.0    SmbShare                            {Get-SmbShare, Remove-SmbShare, Set-SmbShare, Block-SmbShareAccess...}                                                                                                          
Manifest   2.0.0.0    SmbWitness                          {Get-SmbWitnessClient, Move-SmbWitnessClient, gsmbw, msmbw...}                                                                                                                  
Manifest   1.0.0.0    StartLayout                         {Export-StartLayout, Import-StartLayout, Export-StartLayoutEdgeAssets, Get-StartApps}                                                                                           
Manifest   2.0.0.0    Storage                             {Add-InitiatorIdToMaskingSet, Add-PartitionAccessPath, Add-PhysicalDisk, Add-StorageFaultDomain...}                                                                             
Manifest   2.0.0.0    TLS                                 {New-TlsSessionTicketKey, Enable-TlsSessionTicketKey, Disable-TlsSessionTicketKey, Export-TlsSessionTicketKey...}                                                               
Manifest   1.0.0.0    TroubleshootingPack                 {Get-TroubleshootingPack, Invoke-TroubleshootingPack}                                                                                                                           
Manifest   2.0.0.0    TrustedPlatformModule               {Get-Tpm, Initialize-Tpm, Clear-Tpm, Unblock-Tpm...}                                                                                                                            
Manifest   2.0.0.0    VpnClient                           {Add-VpnConnection, Set-VpnConnection, Remove-VpnConnection, Get-VpnConnection...}                                                                                              
Manifest   1.0.0.0    Wdac                                {Get-OdbcDriver, Set-OdbcDriver, Get-OdbcDsn, Add-OdbcDsn...}                                                                                                                   
Manifest   1.0.0.0    WindowsDeveloperLicense             {Get-WindowsDeveloperLicense, Unregister-WindowsDeveloperLicense, Show-WindowsDeveloperLicenseRegistration}                                                                     
Script     1.0        WindowsErrorReporting               {Enable-WindowsErrorReporting, Disable-WindowsErrorReporting, Get-WindowsErrorReporting}                                                                                        
Manifest   1.0.0.0    WindowsSearch                       {Get-WindowsSearchSetting, Set-WindowsSearchSetting}                                                                                                                            
Manifest   1.0.0.0    WindowsUpdate                       Get-WindowsUpdateLog                                                                                                                                                            
Manifest   1.0.0.2    WindowsUpdateProvider               {Get-WUAVersion, Get-WULastInstallationDate, Get-WULastScanSuccessDate, Get-WUIsPendingReboot...}                                                                               

    Directory: C:\Program Files (x86)\Microsoft SQL Server\140\Tools\PowerShell\Modules

ModuleType Version    Name                                ExportedCommands                                                                                                                                                                
---------- -------    ----                                ----------------                                                                                                                                                                
Manifest   14.0       SQLPS                               {Backup-SqlDatabase, Save-SqlMigrationReport, Add-SqlAvailabilityDatabase, Add-SqlAvailabilityGroupListenerStaticIp...}                                                         

    Directory: C:\Users\spael\.vscode\extensions\ms-vscode.powershell-1.10.2\modules

ModuleType Version    Name                                ExportedCommands                                                                                                                                                                
---------- -------    ----                                ----------------                                                                                                                                                                
Script     1.1.3      Plaster                             {Invoke-Plaster, New-PlasterManifest, Get-PlasterTemplate, Test-PlasterManifest}                                                                                                
Script     1.10.2     PowerShellEditorServices            {Start-EditorServicesHost, Get-PowerShellEditorServicesVersion, Compress-LogDir}                                                                                                
Script     0.2.0      PowerShellEditorServices.VSCode     {New-VSCodeHtmlContentView, Show-VSCodeHtmlContentView, Close-VSCodeHtmlContentView, Set-VSCodeHtmlContentView...}                                                              
Script     1.17.1     PSScriptAnalyzer                    {Get-ScriptAnalyzerRule, Invoke-ScriptAnalyzer, Invoke-Formatter}

Environment Data

$PSVersionTable

Name                           Value                                                                                                                                                                                                      
----                           -----                                                                                                                                                                                                      
PSVersion                      5.1.17134.407                                                                                                                                                                                              
PSEdition                      Desktop                                                                                                                                                                                                    
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}                                                                                                                                                                                    
BuildVersion                   10.0.17134.407                                                                                                                                                                                             
CLRVersion                     4.0.30319.42000                                                                                                                                                                                            
WSManStackVersion              3.0                                                                                                                                                                                                        
PSRemotingProtocolVersion      2.3                                                                                                                                                                                                        
SerializationVersion           1.1.0.1

Debug Output

$DebugPreference='Continue'
$nsg | Set-AzNetworkSecurityGroup
DEBUG: 10:12:11 AM - SetAzureNetworkSecurityGroupCommand begin processing with ParameterSet '__AllParameterSets'.
DEBUG: 10:12:11 AM - using account id 'asp@venzo.com'...
DEBUG: [Common.Authentication]: Authenticating using Account: 'asp@venzo.com', environment: 'AzureCloud', tenant: 'b9a44c5c-ec32-467d-8c4b-534b3f2ea9db'
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd?api-version=2018-10-01

Headers:
x-ms-client-request-id        : 93b2b1b8-3391-465c-a051-eed40cb9b0c6
accept-language               : en-US

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma                        : no-cache
x-ms-request-id               : 37e55942-7d25-4494-bef5-351fafa31e19
x-ms-correlation-request-id   : 801d6ff7-0066-4e90-ba56-825ead07e5cb
Strict-Transport-Security     : max-age=31536000; includeSubDomains
Cache-Control                 : no-cache
ETag                          : W/"5296c4dd-d876-43ce-b2dc-019a99093d99"
Server                        : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 11985
x-ms-routing-request-id       : CANADAEAST:20190122T091211Z:801d6ff7-0066-4e90-ba56-825ead07e5cb
X-Content-Type-Options        : nosniff
Date                          : Tue, 22 Jan 2019 09:12:11 GMT

Body:
{
  "name": "NSG-FrontEnd",
  "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd",
  "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
  "type": "Microsoft.Network/networkSecurityGroups",
  "location": "northeurope",
  "properties": {
    "provisioningState": "Succeeded",
    "resourceGuid": "76d01858-b9a5-4aa3-887b-9f3028bec42a",
    "securityRules": [
      {
        "name": "rdp-rule",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/securityRules/rdp-rule",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "type": "Microsoft.Network/networkSecurityGroups/securityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "3389",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "*",
          "access": "Deny",
          "priority": 100,
          "direction": "Inbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      }
    ],
    "defaultSecurityRules": [
      {
        "name": "AllowVnetInBound",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowVnetInBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow inbound traffic from all VMs in VNET",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "VirtualNetwork",
          "destinationAddressPrefix": "VirtualNetwork",
          "access": "Allow",
          "priority": 65000,
          "direction": "Inbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "AllowAzureLoadBalancerInBound",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowAzureLoadBalancerInBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow inbound traffic from azure load balancer",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "AzureLoadBalancer",
          "destinationAddressPrefix": "*",
          "access": "Allow",
          "priority": 65001,
          "direction": "Inbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "DenyAllInBound",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/DenyAllInBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Deny all inbound traffic",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "*",
          "access": "Deny",
          "priority": 65500,
          "direction": "Inbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "AllowVnetOutBound",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowVnetOutBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow outbound traffic from all VMs to all VMs in VNET",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "VirtualNetwork",
          "destinationAddressPrefix": "VirtualNetwork",
          "access": "Allow",
          "priority": 65000,
          "direction": "Outbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "AllowInternetOutBound",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowInternetOutBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow outbound traffic from all VMs to Internet",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "Internet",
          "access": "Allow",
          "priority": 65001,
          "direction": "Outbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "DenyAllOutBound",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/DenyAllOutBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Deny all outbound traffic",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "*",
          "access": "Deny",
          "priority": 65500,
          "direction": "Outbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      }
    ]
  }
}

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd?api-version=2018-10-01

Headers:
x-ms-client-request-id        : 622a5a1a-3809-4c71-be15-2ec51d1bfb84
accept-language               : en-US

Body:
{
  "properties": {
    "securityRules": [
      {
        "properties": {
          "access": "Deny",
          "priority": 0,
          "provisioningState": "Succeeded"
        },
        "name": "rdp-rule",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/securityRules/rdp-rule"
      }
    ],
    "defaultSecurityRules": [
      {
        "properties": {
          "description": "Allow inbound traffic from all VMs in VNET",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "VirtualNetwork",
          "sourceAddressPrefixes": [],
          "destinationAddressPrefix": "VirtualNetwork",
          "destinationAddressPrefixes": [],
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "access": "Allow",
          "priority": 65000,
          "direction": "Inbound",
          "provisioningState": "Succeeded"
        },
        "name": "AllowVnetInBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowVnetInBound"
      },
      {
        "properties": {
          "description": "Allow inbound traffic from azure load balancer",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "AzureLoadBalancer",
          "sourceAddressPrefixes": [],
          "destinationAddressPrefix": "*",
          "destinationAddressPrefixes": [],
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "access": "Allow",
          "priority": 65001,
          "direction": "Inbound",
          "provisioningState": "Succeeded"
        },
        "name": "AllowAzureLoadBalancerInBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowAzureLoadBalancerInBound"
      },
      {
        "properties": {
          "description": "Deny all inbound traffic",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "sourceAddressPrefixes": [],
          "destinationAddressPrefix": "*",
          "destinationAddressPrefixes": [],
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "access": "Deny",
          "priority": 65500,
          "direction": "Inbound",
          "provisioningState": "Succeeded"
        },
        "name": "DenyAllInBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/DenyAllInBound"
      },
      {
        "properties": {
          "description": "Allow outbound traffic from all VMs to all VMs in VNET",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "VirtualNetwork",
          "sourceAddressPrefixes": [],
          "destinationAddressPrefix": "VirtualNetwork",
          "destinationAddressPrefixes": [],
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "access": "Allow",
          "priority": 65000,
          "direction": "Outbound",
          "provisioningState": "Succeeded"
        },
        "name": "AllowVnetOutBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowVnetOutBound"
      },
      {
        "properties": {
          "description": "Allow outbound traffic from all VMs to Internet",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "sourceAddressPrefixes": [],
          "destinationAddressPrefix": "Internet",
          "destinationAddressPrefixes": [],
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "access": "Allow",
          "priority": 65001,
          "direction": "Outbound",
          "provisioningState": "Succeeded"
        },
        "name": "AllowInternetOutBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/AllowInternetOutBound"
      },
      {
        "properties": {
          "description": "Deny all outbound traffic",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "sourceAddressPrefixes": [],
          "destinationAddressPrefix": "*",
          "destinationAddressPrefixes": [],
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "access": "Deny",
          "priority": 65500,
          "direction": "Outbound",
          "provisioningState": "Succeeded"
        },
        "name": "DenyAllOutBound",
        "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
        "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/defaultSecurityRules/DenyAllOutBound"
      }
    ],
    "resourceGuid": "76d01858-b9a5-4aa3-887b-9f3028bec42a",
    "provisioningState": "Succeeded"
  },
  "etag": "W/\"5296c4dd-d876-43ce-b2dc-019a99093d99\"",
  "id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd",
  "location": "northeurope"
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Pragma                        : no-cache
x-ms-request-id               : 8db8debb-a455-4fec-846c-5c986be02b33
x-ms-correlation-request-id   : fe59e2e6-17b5-431f-9bc3-55139e817788
Strict-Transport-Security     : max-age=31536000; includeSubDomains
Cache-Control                 : no-cache
Server                        : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-routing-request-id       : CANADAEAST:20190122T091212Z:fe59e2e6-17b5-431f-9bc3-55139e817788
X-Content-Type-Options        : nosniff
Date                          : Tue, 22 Jan 2019 09:12:11 GMT

Body:
{
  "error": {
    "code": "SecurityRuleParameterMissing",
    "message": "Required security rule parameter Protocol is missing for security rule with Id: /subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/securityRules/rdp-rule.",
    "details": []
  }
}

Set-AzNetworkSecurityGroup : Required security rule parameter Protocol is missing for security rule with Id:
/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/securityRules/rdp-rule.
StatusCode: 400
ReasonPhrase: Bad Request
OperationID : '8db8debb-a455-4fec-846c-5c986be02b33'
At line:1 char:8
+ $nsg | Set-AzNetworkSecurityGroup
+        ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Set-AzNetworkSecurityGroup], NetworkCloudException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Network.SetAzureNetworkSecurityGroupCommand

DEBUG: AzureQoSEvent: CommandName - Set-AzNetworkSecurityGroup; IsSuccess - False; Duration - 00:00:01.2644327; Exception - Microsoft.Azure.Commands.Network.Common.NetworkCloudException: Required security rule parameter Protocol is missing for security rule with Id: /subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/securityRules/rdp-rule.
StatusCode: 400
ReasonPhrase: Bad Request
OperationID : '8db8debb-a455-4fec-846c-5c986be02b33' ---> Microsoft.Rest.Azure.CloudException: Required security rule parameter Protocol is missing for security rule with Id: /subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/TestRG/providers/Microsoft.Network/networkSecurityGroups/NSG-FrontEnd/securityRules/rdp-rule.
   at Microsoft.Azure.Management.Network.NetworkSecurityGroupsOperations.<BeginCreateOrUpdateWithHttpMessagesAsync>d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Management.Network.NetworkSecurityGroupsOperations.<CreateOrUpdateWithHttpMessagesAsync>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Management.Network.NetworkSecurityGroupsOperationsExtensions.<CreateOrUpdateAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Management.Network.NetworkSecurityGroupsOperationsExtensions.CreateOrUpdate(INetworkSecurityGroupsOperations operations, String resourceGroupName, String networkSecurityGroupName, NetworkSecurityGroup parameters)
   at Microsoft.Azure.Commands.Network.SetAzureNetworkSecurityGroupCommand.Execute()
   at Microsoft.Azure.Commands.Network.NetworkBaseCmdlet.ExecuteCmdlet()
   --- End of inner exception stack trace ---
   at Microsoft.Azure.Commands.Network.NetworkBaseCmdlet.ExecuteCmdlet()
   at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord();
DEBUG: Finish sending metric.
DEBUG: 10:12:12 AM - SetAzureNetworkSecurityGroupCommand end processing.
DEBUG: 10:12:12 AM - SetAzureNetworkSecurityGroupCommand end processing.

sphibbs commented 5 years ago

@avijitgupta @chandrasekarsrinivasan @MikhailTryakhov can you take a look? Piping should work here.

EvgenyAgafonchikov commented 5 years ago

Basing on the current implementation, this seems to be expected behavior. You have to re-specify all the parameters in Set to avoid dropping values or setting them to defaults. Please find discussion of similar issue there: https://github.com/Azure/azure-powershell/issues/3493#issuecomment-456383703

@sphibbs, I looked through open issues and there are some similar, for example https://github.com/Azure/azure-powershell/issues/5145.

Basing on the discussion referenced above, we may need to "merge" these issues and decide on common solution for them. Simple solution looks like wrapping

prop = this.prop;

constructions into

if(this.prop != null)
{
    prop = this.prop;
}

for required properties to avoid dropping them, while optional still could be nullified. However, per discussion there is another request: to have incremental Set version that would keep optional properties too. And this is the thing that requires universal solution discussion.

spaelling commented 5 years ago

Basing on the current implementation, this seems to be expected behavior. You have to re-specify all the parameters in Set to avoid dropping values or setting them to defaults. Please find discussion of similar issue there: #3493 (comment)

@sphibbs, I looked through open issues and there are some similar, for example #5145.

Basing on the discussion referenced above, we may need to "merge" these issues and decide on common solution for them. Simple solution looks like wrapping
prop = this.prop;
constructions into
if(this.prop != null)
{
    prop = this.prop;
}
for required properties to avoid dropping them, while optional still could be nullified. However, per discussion there is another request: to have incremental Set version that would keep optional properties too. And this is the thing that requires universal solution discussion.

I think that is an unfortunate expected behavior. If I have to specify every single parameter then the cmdlet is not of much assistance, I would rather, change the object directly.

Also the example in docs.microsoft.com as below is then wrong.

$nsg = Get-AzNetworkSecurityGroup -Name "NSG-FrontEnd" -ResourceGroupName "TestRG"
$nsg | Get-AzNetworkSecurityRuleConfig -Name "rdp-rule"
Set-AzNetworkSecurityRuleConfig -Name "rdp-rule" -NetworkSecurityGroup $nsg -Access "Deny"

I can see the argument that omitting parameter can be used to drop the property, or set to some default value, but in the case of dropping I would like to do that explicitly. In that case

if(this.prop != null)
{
    prop = this.prop;
}

would not work, as the property would be maintained and not dropped as specified (if using -Parameter $null to drop it)

Anyhow, it would be a breaking change. Alternatively a new cmdlet

Edit-AzNetworkSecurityRuleConfig -Name "rdp-rule" -NetworkSecurityGroup $nsg -Access "Deny"

LucianFrango commented 5 years ago

+1 in that I am experiencing this issue as well. The example does not work as per @spaelling outlined in this previous comment on Jan 24th. Still no resolved as of July 2019.

iyoumans commented 5 years ago

+1 I too am experiencing this problem as of July 17, 2019. An update command where I have to map all of the old values in addition to the one I want to change is a pain.

spaelling commented 5 years ago

+1 I too am experiencing this problem as of July 17, 2019. An update command where I have to map all of the old values in addition to the one I want to change is a pain.

There is a workaround you can use until then

# we can do it "manually"
$nsg = Get-AzNetworkSecurityGroup -Name "NSG-FrontEnd" -ResourceGroupName "TestRG"
($nsg.SecurityRules | Where-Object {$_.Name -eq 'rdp-rule'}).Access = 'Deny'
# updating NSG works fine now
$nsg | Set-AzNetworkSecurityGroup | Get-AzNetworkSecurityRuleConfig -Name "rdp-rule" | Format-Table -AutoSize
<# OUTPUT
Description Protocol SourcePortRange DestinationPortRange SourceAddressPrefix DestinationAddressPrefix Access Priority Direction ProvisioningState
----------- -------- --------------- -------------------- ------------------- ------------------------ ------ -------- --------- -----------------
            *        {*}             {3389}               {*}                 {*}                      Deny        100 Inbound   Succeeded
#>

iyoumans commented 5 years ago

Thanks! I wouldn't have thought of updating it as a property of the NSG vs the Rule object.

UmairSyed commented 4 years ago

I am facing a similar issue when i am trying to use ARM template to deploy NSG rule "allowInternetInbound" and the protocol is "Any". The template uses "protocol": "*". I am getting the following error during deployment "message": "Required security rule parameter Protocol is missing for security rule with Id: /subscriptions/xx/resourceGroups/xx/providers/Microsoft.Network/networkSecurityGroups/xx/securityRules/AllowInternetInBound.",".

hobbesuk commented 4 years ago

Thanks for the workaround, the docs really need updating as they don't work

cadams84 commented 3 years ago

@spaelling I can change the access using the workaround but not the SourceAddressPrefix. Should this be possible?

rventurelli commented 3 years ago

@cadams84 it worked also for SourceAddressPrefix:

$nsg = Get-AzNetworkSecurityGroup -ResourceGroupName "MyResource" -Name "MyNsg"
($nsg.SecurityRules | Where-Object {$_.Name -eq "RuleName"}).SourceAddressPrefix = ([System.String[]] @("xxx.xxx.xxx.xxx"))
$nsg | Set-AzNetworkSecurityGroup | Get-AzNetworkSecurityRuleConfig -Name "RuleName"

cadams84 commented 3 years ago

@rventurelli thank you. This has partially resolved my problem so let me explain in more detail. I have connected a webhook to my runbook. My powershell script contains the webhook:

Write-Output "Changing IP Address..."

$uri = "https://webhookaddress"

$nsg = @{ SourceAddressPrefix = ([System.String[]] @("123.123.123.12")) Name = "NSG_Rule_Name" }

$body = ConvertTo-Json -InputObject $nsg $header = @{ message="StartedbyContoso"} $response = Invoke-WebRequest -Method Post -Uri $uri -Body $body -Headers $header $jobid = (ConvertFrom-Json ($response.Content)).jobids[0]

The runbook input parameter accepts the WEBHOOKDATA as JSON:

{"WebhookName":"UpdateIPAddress","RequestBody":"{\r\n \"Name\": \"NSG_Rule_Name\",\r\n \"SourceAddressPrefix\": [\r\n \"123.123.123.12\"\r\n ]\r\n}","RequestHeader":{"Connection":"Keep-Alive","Host":"33ce53a59d11.webhook.ne.azure-automation.net","User-Agent":"Mozilla/5.0","message":"StartedbyContoso","x-ms-request-id":"7c7c8934-0445-478c-84fd-a6761eadc79b"}}

But when trying to pass $nsg.SourceAddressPrefix in the runbook, it fails. If I don't cast the IP to a string in the webhook script, it will fail to be in the JSON. So now I'm trying to cast the string back to an integer within the runbook.

Your powershell example works fine for me if I specify the IP within the runbook. I am trying to specify it in a webhook script and pass it through to the runbook:

$nsg = Get-AzNetworkSecurityGroup -Name "NSG_Name" -ResourceGroupName "RG_Name" $nsg | Get-AzNetworkSecurityRuleConfig -Name "NSG_Rule_Name" Set-AzNetworkSecurityRuleConfig -Name "NSG_Rule_Name" -NetworkSecurityGroup $nsg -SourceAddressPrefix = $nsg.SourceAddressPrefix

webguynj commented 3 years ago

Please provide a working powershell function to allow updating parameter of a NetworkSecurityGroupConfig rule that does not clobber exisitng attibutes of the rule as the documentation describes. Also, it would be beneficial for Set-AzNetworkSecurityRuleConfig to accept a rule as pipeline input if indeed you can't use this without clobbering all existing attributes of a rule

smilingcircuits commented 3 years ago

Please provide a working powershell function to allow updating parameter of a NetworkSecurityGroupConfig rule that does not clobber exisitng attibutes of the rule as the documentation describes. Also, it would be beneficial for Set-AzNetworkSecurityRuleConfig to accept a rule as pipeline input if indeed you can't use this without clobbering all existing attributes of a rule

Agreed, an edit option/append for rule updates would be a very useful tool for scripting. And to the original purpose of opening the thread, the incorrect example in the documentation persists.

Azure / azure-powershell