Azure Networking Services Authentication Policies API

openapi: 3.2.0
info:
  title: WebApplicationFirewallManagement Authentication Policies API
  version: '2026-03-01'
  description: APIs to manage Microsoft Azure network resources.
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: AuthenticationPolicies
paths:
  /subscriptions/{subscriptionId}/providers/Microsoft.Network/authenticationPolicies:
    get:
      operationId: AuthenticationPolicies_ListAll
      tags:
      - AuthenticationPolicies
      description: Gets all the authentication policies in a subscription.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationPolicyListResult'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Authentication policies list all
      x-summary-source: derived
  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/authenticationPolicies:
    get:
      operationId: AuthenticationPolicies_List
      tags:
      - AuthenticationPolicies
      description: Lists all of the authentication policies within a resource group.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationPolicyListResult'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Authentication policies list
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/authenticationPolicies/{authenticationPolicyName}
  : get:
      operationId: AuthenticationPolicies_Get
      tags:
      - AuthenticationPolicies
      description: Retrieve the authentication policy with specified name within a resource group.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: authenticationPolicyName
        in: path
        description: The name of the authentication policy.
        required: true
        schema:
          type: string
          maxLength: 80
          pattern: ^[A-Za-z0-9_-]{1,80}$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationPolicy'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      summary: Authentication policies get
      x-summary-source: derived
    put:
      operationId: AuthenticationPolicies_CreateOrUpdate
      tags:
      - AuthenticationPolicies
      description: Creates or updates an authentication policy with the specified name within a resource group.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: authenticationPolicyName
        in: path
        description: The name of the authentication policy.
        required: true
        schema:
          type: string
          maxLength: 80
          pattern: ^[A-Za-z0-9_-]{1,80}$
      responses:
        '200':
          description: Resource 'AuthenticationPolicy' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationPolicy'
        '201':
          description: Resource 'AuthenticationPolicy' create operation succeeded
          headers:
            Azure-AsyncOperation:
              description: A link to the status monitor
              schema:
                type: string
            Retry-After:
              description: The Retry-After header can indicate how long the client should wait before polling the operation status.
              schema:
                type: integer
                format: int32
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationPolicy'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-long-running-operation-options:
        final-state-via: azure-async-operation
        final-state-schema: '#/definitions/AuthenticationPolicy'
      x-ms-long-running-operation: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthenticationPolicy'
        description: Authentication policy to be created or updated.
        required: true
      summary: Authentication policies create or update
      x-summary-source: derived
    patch:
      operationId: AuthenticationPolicies_Update
      tags:
      - AuthenticationPolicies
      description: Updates the tags and identity of an authentication policy.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: authenticationPolicyName
        in: path
        description: The name of the authentication policy.
        required: true
        schema:
          type: string
          maxLength: 80
          pattern: ^[A-Za-z0-9_-]{1,80}$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationPolicy'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthenticationPolicyUpdateParameters'
        description: Parameters supplied to update the authentication policy.
        required: true
      summary: Authentication policies update
      x-summary-source: derived
    delete:
      operationId: AuthenticationPolicies_Delete
      tags:
      - AuthenticationPolicies
      description: Deletes the specified authentication policy.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: authenticationPolicyName
        in: path
        description: The name of the authentication policy.
        required: true
        schema:
          type: string
          maxLength: 80
          pattern: ^[A-Za-z0-9_-]{1,80}$
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      summary: Authentication policies delete
      x-summary-source: derived
components:
  parameters:
    SubscriptionIdParameter:
      name: subscriptionId
      in: path
      description: The ID of the target subscription. The value must be an UUID.
      required: true
      schema:
        type: string
        format: uuid
    ResourceGroupNameParameter:
      name: resourceGroupName
      in: path
      description: The name of the resource group. The name is case insensitive.
      required: true
      x-ms-parameter-location: method
      schema:
        type: string
        maxLength: 90
        minLength: 1
    ApiVersionParameter:
      name: api-version
      in: query
      description: The API version to use for this operation.
      required: true
      schema:
        type: string
        minLength: 1
  schemas:
    Resource:
      type: object
      description: Common resource representation.
      properties:
        id:
          type: string
          description: Resource ID.
        name:
          type: string
          description: Resource name.
          readOnly: true
        type:
          type: string
          description: Resource type.
          readOnly: true
        location:
          type: string
          description: Resource location.
        tags:
          type: object
          description: Resource tags.
          additionalProperties:
            type: string
      x-ms-azure-resource: true
    systemData:
      type: object
      description: Metadata pertaining to creation and last modification of the resource.
      properties:
        createdBy:
          type: string
          description: The identity that created the resource.
        createdByType:
          type: string
          description: The type of identity that created the resource.
          enum:
          - User
          - Application
          - ManagedIdentity
          - Key
          x-ms-enum:
            name: createdByType
            modelAsString: true
        createdAt:
          type: string
          format: date-time
          description: The timestamp of resource creation (UTC).
        lastModifiedBy:
          type: string
          description: The identity that last modified the resource.
        lastModifiedByType:
          type: string
          description: The type of identity that last modified the resource.
          enum:
          - User
          - Application
          - ManagedIdentity
          - Key
          x-ms-enum:
            name: createdByType
            modelAsString: true
        lastModifiedAt:
          type: string
          format: date-time
          description: The timestamp of resource last modification (UTC)
      readOnly: true
    UserTrustProviderType:
      type: string
      description: Type of the user trust provider.
      enum:
      - entra
      x-ms-enum:
        name: UserTrustProviderType
        modelAsString: true
        values:
        - name: Entra
          value: entra
          description: Microsoft Entra trust provider type.
    AuthenticationScope:
      type: string
      description: An authentication scope value.
      minLength: 1
      maxLength: 128
      pattern: ^[A-Za-z0-9_.:/-]+$
    AuthenticationPolicyPropertiesFormat:
      type: object
      description: Properties of the authentication policy.
      properties:
        userTrustProviderType:
          $ref: '#/components/schemas/UserTrustProviderType'
          description: The type of the user trust provider. Only Microsoft Entra is supported, using the serialized value `entra`.
        onUnauthenticatedRequest:
          $ref: '#/components/schemas/OnUnauthenticatedRequest'
          description: The action to take when a request is unauthenticated. When omitted, user sign-in policies default to `authenticate` and JWT validation policies default to `deny`.
        authenticationProperties:
          $ref: '#/components/schemas/AuthenticationProviderProperties'
          description: The authentication provider configuration for the policy.
        associatedResources:
          type: array
          description: A collection of resource IDs that reference this authentication policy.
          items:
            type: string
          readOnly: true
        provisioningState:
          $ref: '#/components/schemas/ProvisioningState'
          description: The provisioning state of the authentication policy resource.
          readOnly: true
        resourceGuid:
          type: string
          description: The resource GUID property of the authentication policy resource.
          readOnly: true
      required:
      - userTrustProviderType
      - authenticationProperties
    AuthenticationProviderProperties:
      type: object
      description: Properties for authentication provider configuration. A policy must configure either JWT validation fields or user sign-in fields; the two configurations are mutually exclusive and cannot be combined.
      properties:
        issuer:
          type: string
          format: uri
          description: 'The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/'
          maxLength: 2048
          pattern: ^[Hh][Tt][Tt][Pp][Ss]://
        jwksUri:
          type: string
          format: uri
          description: 'The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys'
          maxLength: 2048
          pattern: ^[Hh][Tt][Tt][Pp][Ss]://
        audience:
          type: string
          description: 'The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id}'
          maxLength: 2048
        clientId:
          type: string
          description: The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID.
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        clientSecret:
          type: string
          format: uri
          description: 'The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource''s user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret'
          pattern: ^[Hh][Tt][Tt][Pp][Ss]://
        scope:
          type: array
          description: The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined.
          maxItems: 10
          items:
            $ref: '#/components/schemas/AuthenticationScope'
        sessionTimeout:
          type: string
          description: The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example `86400`). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow.
          maxLength: 6
          pattern: ^[1-9][0-9]{0,5}$
        sessionCookieName:
          type: string
          description: The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow.
          maxLength: 256
          pattern: ^[A-Za-z0-9_-]+$
      required:
      - issuer
      - clientId
    AuthenticationPolicyUpdateParameters:
      type: object
      description: Parameters supplied to update an authentication policy.
      properties:
        tags:
          type: object
          description: Resource tags.
          additionalProperties:
            type: string
        identity:
          $ref: '#/components/schemas/ManagedServiceIdentity'
          description: The user-assigned identity used by a user sign-in policy to access its Key Vault client secret.
    AuthenticationPolicyListResult:
      type: object
      description: The response of a AuthenticationPolicy list operation.
      properties:
        value:
          type: array
          description: The AuthenticationPolicy items on this page
          items:
            $ref: '#/components/schemas/AuthenticationPolicy'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
      required:
      - value
    AuthenticationPolicy:
      type: object
      description: Authentication policy resource for identity integration.
      properties:
        properties:
          $ref: '#/components/schemas/AuthenticationPolicyPropertiesFormat'
          description: Properties of the authentication policy.
        etag:
          type: string
          description: A unique read-only string that changes whenever the resource is updated.
          readOnly: true
        identity:
          $ref: '#/components/schemas/ManagedServiceIdentity'
          description: The user-assigned identity used by a user sign-in policy to access its Key Vault client secret.
        systemData:
          $ref: '#/components/schemas/systemData'
          description: The system metadata related to this resource.
          readOnly: true
      allOf:
      - $ref: '#/components/schemas/Resource'
    ProvisioningState:
      type: string
      description: Provisioning states of a resource.
      enum:
      - Failed
      - Succeeded
      - Canceled
      - Creating
      - Updating
      - Deleting
      x-ms-enum:
        name: ProvisioningState
        modelAsString: true
        values:
        - name: Failed
          value: Failed
          description: Failed
        - name: Succeeded
          value: Succeeded
          description: Succeeded
        - name: Canceled
          value: Canceled
          description: Canceled
        - name: Creating
          value: Creating
          description: Creating
        - name: Updating
          value: Updating
          description: Updating
        - name: Deleting
          value: Deleting
          description: Deleting
    ManagedServiceIdentity:
      type: object
      description: Identity for the resource.
      properties:
        principalId:
          type: string
          description: The principal id of the system assigned identity. This property will only be provided for a system assigned identity.
          readOnly: true
        tenantId:
          type: string
          description: The tenant id of the system assigned identity. This property will only be provided for a system assigned identity.
          readOnly: true
        type:
          $ref: '#/components/schemas/ResourceIdentityType'
          description: The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine.
        userAssignedIdentities:
          type: object
          description: 'The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: ''/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}''.'
          additionalProperties:
            $ref: '#/components/schemas/ManagedServiceIdentityUserAssignedIdentities'
    OnUnauthenticatedRequest:
      type: string
      description: Action to take when a request is unauthenticated.
      enum:
      - allow
      - authenticate
      - deny
      x-ms-enum:
        name: OnUnauthenticatedRequest
        modelAsString: true
        values:
        - name: Allow
          value: allow
          description: Allow the request to pass through without authentication.
        - name: Authenticate
          value: authenticate
          description: Redirect the request to the authentication provider. Only valid for the user authentication capability.
        - name: Deny
          value: deny
          description: Deny the request when no credential is presented.
    CloudError:
      type: object
      description: An error response from the service.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Cloud error body.
      x-ms-external: true
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.