diff --git a/Commands/agentfabric/_create.md b/Commands/agentfabric/_create.md
new file mode 100644
index 000000000..d44f81432
--- /dev/null
+++ b/Commands/agentfabric/_create.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric create_
+
+Create an Agent Fabric resource.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{} 2026-07-21-preview -->
+
+#### examples
+
+- AgentFabrics_CreateOrUpdate
+    ```bash
+        agentfabric create --resource-group rgnetworksecurity --name testAIFabric --default-policy-groups "[/subscriptions/11809CA1-E126-4017-945E-AA795CD5C5A9/resourceGroups/rgnetworksecurity/providers/Microsoft.NetworkSecurity/policyGroups/testPolicyGroup]" --trust-domain contoso.agentfabric --tags "{}" --location eastus
+    ```
diff --git a/Commands/agentfabric/_delete.md b/Commands/agentfabric/_delete.md
new file mode 100644
index 000000000..ea5177795
--- /dev/null
+++ b/Commands/agentfabric/_delete.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric delete_
+
+Delete an Agent Fabric resource.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{} 2026-07-21-preview -->
+
+#### examples
+
+- AgentFabrics_Delete
+    ```bash
+        agentfabric delete --resource-group rgnetworksecurity --name testAIFabric
+    ```
diff --git a/Commands/agentfabric/_list.md b/Commands/agentfabric/_list.md
new file mode 100644
index 000000000..8f942dc57
--- /dev/null
+++ b/Commands/agentfabric/_list.md
@@ -0,0 +1,22 @@
+# [Command] _agentfabric list_
+
+List Agent Fabric resources.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNz/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/providers/microsoft.networksecurity/agentfabrics 2026-07-21-preview -->
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics 2026-07-21-preview -->
+
+#### examples
+
+- AgentFabrics_ListBySubscription
+    ```bash
+        agentfabric list
+    ```
+
+- AgentFabrics_ListByResourceGroup
+    ```bash
+        agentfabric list --resource-group rgnetworksecurity
+    ```
diff --git a/Commands/agentfabric/_show.md b/Commands/agentfabric/_show.md
new file mode 100644
index 000000000..baf2607c4
--- /dev/null
+++ b/Commands/agentfabric/_show.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric show_
+
+Show an Agent Fabric resource.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{} 2026-07-21-preview -->
+
+#### examples
+
+- AgentFabrics_Get
+    ```bash
+        agentfabric show --resource-group rgnetworksecurity --name testAIFabric
+    ```
diff --git a/Commands/agentfabric/_update.md b/Commands/agentfabric/_update.md
new file mode 100644
index 000000000..4c7571f56
--- /dev/null
+++ b/Commands/agentfabric/_update.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric update_
+
+Update an Agent Fabric resource.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{} 2026-07-21-preview -->
+
+#### examples
+
+- AgentFabrics_Update
+    ```bash
+        agentfabric update --resource-group rgnetworksecurity --name testAIFabric --tags "{env:production}"
+    ```
diff --git a/Commands/agentfabric/aks/_attach.md b/Commands/agentfabric/aks/_attach.md
new file mode 100644
index 000000000..96728fe37
--- /dev/null
+++ b/Commands/agentfabric/aks/_attach.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric aks attach_
+
+Attach an AKS cluster to an Agent Fabric. The parent Fabric name and AKS cluster name are required.
+
+## Versions
+
+### [2026-09-10-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{} 2026-09-10-preview -->
+
+#### examples
+
+- Attach an AKS cluster
+    ```bash
+        agentfabric aks attach --resource-group rgnetworksecurity --fabric-name testAIFabric --cluster-name testCluster --cluster-resource-id /subscriptions/11809CA1-E126-4017-945E-AA795CD5C5A9/resourceGroups/rgaks/providers/Microsoft.ContainerService/managedClusters/testCluster --sku Standard
+    ```
diff --git a/Commands/agentfabric/aks/_detach.md b/Commands/agentfabric/aks/_detach.md
new file mode 100644
index 000000000..9148a2c25
--- /dev/null
+++ b/Commands/agentfabric/aks/_detach.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric aks detach_
+
+Detach an AKS cluster from an Agent Fabric. The parent Fabric name and AKS cluster name are required.
+
+## Versions
+
+### [2026-09-10-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{} 2026-09-10-preview -->
+
+#### examples
+
+- Detach an AKS cluster
+    ```bash
+        agentfabric aks detach --resource-group rgnetworksecurity --fabric-name testAIFabric --cluster-name testCluster
+    ```
diff --git a/Commands/agentfabric/aks/_list.md b/Commands/agentfabric/aks/_list.md
new file mode 100644
index 000000000..686f5485c
--- /dev/null
+++ b/Commands/agentfabric/aks/_list.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric aks list_
+
+List AKS cluster enrollments for an Agent Fabric. The parent Fabric name is required.
+
+## Versions
+
+### [2026-09-10-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnM=/2026-09-10-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations 2026-09-10-preview -->
+
+#### examples
+
+- List AKS cluster enrollments
+    ```bash
+        agentfabric aks list --resource-group rgnetworksecurity --fabric-name testAIFabric
+    ```
diff --git a/Commands/agentfabric/aks/_show.md b/Commands/agentfabric/aks/_show.md
new file mode 100644
index 000000000..978d881d4
--- /dev/null
+++ b/Commands/agentfabric/aks/_show.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric aks show_
+
+Show an AKS cluster enrollment for an Agent Fabric. The parent Fabric name and AKS cluster name are required.
+
+## Versions
+
+### [2026-09-10-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{} 2026-09-10-preview -->
+
+#### examples
+
+- Show an AKS cluster enrollment
+    ```bash
+        agentfabric aks show --resource-group rgnetworksecurity --fabric-name testAIFabric --cluster-name testCluster
+    ```
diff --git a/Commands/agentfabric/aks/_update.md b/Commands/agentfabric/aks/_update.md
new file mode 100644
index 000000000..fb8b9411b
--- /dev/null
+++ b/Commands/agentfabric/aks/_update.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric aks update_
+
+Update the SKU for an AKS cluster enrollment. The parent Fabric name and AKS cluster name are required.
+
+## Versions
+
+### [2026-09-10-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{} 2026-09-10-preview -->
+
+#### examples
+
+- Update an AKS cluster enrollment SKU
+    ```bash
+        agentfabric aks update --resource-group rgnetworksecurity --fabric-name testAIFabric --cluster-name testCluster --sku Premium
+    ```
diff --git a/Commands/agentfabric/aks/readme.md b/Commands/agentfabric/aks/readme.md
new file mode 100644
index 000000000..fc64657d2
--- /dev/null
+++ b/Commands/agentfabric/aks/readme.md
@@ -0,0 +1,20 @@
+# [Group] _agentfabric aks_
+
+Manage AKS cluster enrollment with an Agent Fabric. Commands use the AKS cluster name as the association child name and require the parent Fabric name.
+
+## Commands
+
+- [attach](/Commands/agentfabric/aks/_attach.md)
+: Attach an AKS cluster to an Agent Fabric. The parent Fabric name and AKS cluster name are required.
+
+- [detach](/Commands/agentfabric/aks/_detach.md)
+: Detach an AKS cluster from an Agent Fabric. The parent Fabric name and AKS cluster name are required.
+
+- [list](/Commands/agentfabric/aks/_list.md)
+: List AKS cluster enrollments for an Agent Fabric. The parent Fabric name is required.
+
+- [show](/Commands/agentfabric/aks/_show.md)
+: Show an AKS cluster enrollment for an Agent Fabric. The parent Fabric name and AKS cluster name are required.
+
+- [update](/Commands/agentfabric/aks/_update.md)
+: Update the SKU for an AKS cluster enrollment. The parent Fabric name and AKS cluster name are required.
diff --git a/Commands/agentfabric/member/_create.md b/Commands/agentfabric/member/_create.md
new file mode 100644
index 000000000..7e9efdb18
--- /dev/null
+++ b/Commands/agentfabric/member/_create.md
@@ -0,0 +1,21 @@
+# [Command] _agentfabric member create_
+
+Create a member resource as a child of an Agent Fabric. The parent Fabric name is required.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{} 2026-07-21-preview -->
+
+#### examples
+
+- Members_CreateOrUpdate
+    ```bash
+        agentfabric member create --resource-group rgnetworksecurity --fabric-name testAIFabric --member-name testMember --location eastus --workload "{aci:{resource-id:/subscriptions/11809CA1-E126-4017-945E-AA795CD5C5A9/resourceGroups/rgnetworksecurity/providers/Microsoft.ContainerInstance/containerGroups/testContainerGroup}}"
+    ```
+
+- Members_CreateOrUpdate_AgentFabricSandbox
+    ```bash
+        agentfabric member create --resource-group rgnetworksecurity --fabric-name testAIFabric --member-name sandboxMember --location eastus --workload "{agent-fabric-sandbox:{image:{uri:'contoso.azurecr.io/agents/sandbox:1.0.0',digest:'sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae',pull-policy:IfNotPresent},resources:{cpu:2,memory:4Gi,disk:20Gi},agent-identity:{tenant-id:72f988bf-86f1-41af-91ab-2d7cd011db47,agent-id:aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee},endpoints:[{name:http,port:8080}],domain:sandbox-member.testaifabric.contoso.com}}"
+    ```
diff --git a/Commands/agentfabric/member/_delete.md b/Commands/agentfabric/member/_delete.md
new file mode 100644
index 000000000..b6b3bf58d
--- /dev/null
+++ b/Commands/agentfabric/member/_delete.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric member delete_
+
+Delete a member resource that is a child of an Agent Fabric. The parent Fabric name is required.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{} 2026-07-21-preview -->
+
+#### examples
+
+- Members_Delete
+    ```bash
+        agentfabric member delete --resource-group rgnetworksecurity --fabric-name testAIFabric --member-name testMember
+    ```
diff --git a/Commands/agentfabric/member/_list.md b/Commands/agentfabric/member/_list.md
new file mode 100644
index 000000000..1ccc9ea6f
--- /dev/null
+++ b/Commands/agentfabric/member/_list.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric member list_
+
+List member resources that are children of an Agent Fabric. The parent Fabric name is required.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnM=/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members 2026-07-21-preview -->
+
+#### examples
+
+- Members_ListByParent
+    ```bash
+        agentfabric member list --resource-group rgnetworksecurity --fabric-name testAIFabric
+    ```
diff --git a/Commands/agentfabric/member/_show.md b/Commands/agentfabric/member/_show.md
new file mode 100644
index 000000000..c1d6ce65c
--- /dev/null
+++ b/Commands/agentfabric/member/_show.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric member show_
+
+Show a member resource that is a child of an Agent Fabric. The parent Fabric name is required.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{} 2026-07-21-preview -->
+
+#### examples
+
+- Members_Get
+    ```bash
+        agentfabric member show --resource-group rgnetworksecurity --fabric-name testAIFabric --member-name testMember
+    ```
diff --git a/Commands/agentfabric/member/_update.md b/Commands/agentfabric/member/_update.md
new file mode 100644
index 000000000..89000cd19
--- /dev/null
+++ b/Commands/agentfabric/member/_update.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric member update_
+
+Update a member resource that is a child of an Agent Fabric. The parent Fabric name is required.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{} 2026-07-21-preview -->
+
+#### examples
+
+- Members_Update
+    ```bash
+        agentfabric member update --resource-group rgnetworksecurity --fabric-name testAIFabric --member-name testMember --tags "{environment:production}"
+    ```
diff --git a/Commands/agentfabric/member/readme.md b/Commands/agentfabric/member/readme.md
new file mode 100644
index 000000000..5464ee63a
--- /dev/null
+++ b/Commands/agentfabric/member/readme.md
@@ -0,0 +1,20 @@
+# [Group] _agentfabric member_
+
+Manage members that are children of an Agent Fabric. The parent Fabric name is required.
+
+## Commands
+
+- [create](/Commands/agentfabric/member/_create.md)
+: Create a member resource as a child of an Agent Fabric. The parent Fabric name is required.
+
+- [delete](/Commands/agentfabric/member/_delete.md)
+: Delete a member resource that is a child of an Agent Fabric. The parent Fabric name is required.
+
+- [list](/Commands/agentfabric/member/_list.md)
+: List member resources that are children of an Agent Fabric. The parent Fabric name is required.
+
+- [show](/Commands/agentfabric/member/_show.md)
+: Show a member resource that is a child of an Agent Fabric. The parent Fabric name is required.
+
+- [update](/Commands/agentfabric/member/_update.md)
+: Update a member resource that is a child of an Agent Fabric. The parent Fabric name is required.
diff --git a/Commands/agentfabric/policy-group/_create.md b/Commands/agentfabric/policy-group/_create.md
new file mode 100644
index 000000000..7d632866b
--- /dev/null
+++ b/Commands/agentfabric/policy-group/_create.md
@@ -0,0 +1,36 @@
+# [Command] _agentfabric policy-group create_
+
+Create an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{} 2026-07-21-preview -->
+
+#### examples
+
+- PolicyGroups_CreateOrUpdate
+    ```bash
+        agentfabric policy-group create --resource-group rgnetworksecurity --name testPolicyGroup --location eastus --tags "{env:test}" --display-name "Test Policy Group" --description "A policy group for testing" --priority 100 --network-security-policies "[{fqdn-filtering:{name:allowOutbound,priority:10,direction:Outbound,ports:[443,80],source:{workload-id-patterns:{patterns:[workload1,workload2]}},destination:{fqdns:{fqdns:[example.com,contoso.com]}}}}]"
+    ```
+
+- PolicyGroups_CreateOrUpdate_ContentInspection
+    ```bash
+        agentfabric policy-group create --resource-group rgnetworksecurity --name contentInspectionGroup --location eastus --tags "{env:test}" --display-name "Content Inspection Policy Group" --description "A policy group demonstrating content inspection policies" --priority 100 --network-security-policies "[{content-inspection:{source:{workload-id-patterns:{patterns:['spiffe://contoso.com/ns/default/sa/*']}},prompt-injection-protection:{sensitivity:High,prompt-locations:['$.messages[*].content','$.input'],response-locations:['$.choices[*].message.content'],on-detection:BlockAndAlert}}}]"
+    ```
+
+- PolicyGroups_CreateOrUpdate_Mcp
+    ```bash
+        agentfabric policy-group create --resource-group rgnetworksecurity --name mcpPolicyGroup --location eastus --tags "{env:test}" --display-name "MCP Policy Group" --description "A policy group demonstrating MCP server policies" --priority 100 --network-security-policies "[{mcp:{default-action:Deny,source:{workload-id-patterns:{patterns:['spiffe://contoso.com/ns/default/sa/*']}},destination:{workload-id-patterns:{patterns:['spiffe://contoso.com/ns/mcp/sa/*']}},rules:[{action:Allow,tools:[search,fetch]},{action:Deny,tools:[deleteFile]}]}},{mcp:{default-action:Allow,source:{workload-id-patterns:{patterns:['spiffe://contoso.com/ns/default/sa/*']}},destination:{fqdns:{fqdns:[mcp.contoso.com]}},rules:[{action:Deny,tools:[executeShell,writeFile]}]}},{mcp:{default-action:Deny,source:{workload-id-patterns:{patterns:['spiffe://contoso.com/ns/default/sa/*']}},destination:{address-prefixes:{prefixes:[10.0.0.0/24]}},rules:[{action:Allow,tools:[listResources,readResource]}]}}]"
+    ```
+
+- PolicyGroups_CreateOrUpdate_TlsInspection
+    ```bash
+        agentfabric policy-group create --resource-group rgnetworksecurity --name tlsInspectionPolicyGroup --location eastus --tags "{env:test}" --display-name "TLS Inspection Policy Group" --description "A policy group demonstrating TLS inspection policies" --priority 100 --network-security-policies "[{tls-inspection:{source:{workload-id-patterns:{patterns:['spiffe://contoso.com/ns/default/sa/*']}},certificate:{azure-managed-ca:{}}}}]"
+    ```
+
+- PolicyGroups_CreateOrUpdate_UrlFiltering
+    ```bash
+        agentfabric policy-group create --resource-group rgnetworksecurity --name urlFilteringPolicyGroup --location eastus --tags "{env:test}" --display-name "URL Filtering Policy Group" --description "A policy group demonstrating URL filtering" --priority 100 --network-security-policies "[{url-filtering:{default-action:Deny,source:{address-prefixes:{prefixes:[10.0.0.0/24]}},destination:{fqdns:{fqdns:[api.contoso.com]}},rules:[{name:allowProductApi,priority:10,hostname:api.contoso.com,method:GET,paths:['/v1/products','/v1/products/*'],action:Allow},{name:denyAdmin,priority:20,paths:['/admin/*'],action:Deny}]}}]"
+    ```
diff --git a/Commands/agentfabric/policy-group/_delete.md b/Commands/agentfabric/policy-group/_delete.md
new file mode 100644
index 000000000..c33ddbe47
--- /dev/null
+++ b/Commands/agentfabric/policy-group/_delete.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric policy-group delete_
+
+Delete an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{} 2026-07-21-preview -->
+
+#### examples
+
+- PolicyGroups_Delete
+    ```bash
+        agentfabric policy-group delete --resource-group rgnetworksecurity --name testPolicyGroup
+    ```
diff --git a/Commands/agentfabric/policy-group/_list.md b/Commands/agentfabric/policy-group/_list.md
new file mode 100644
index 000000000..18cacb03c
--- /dev/null
+++ b/Commands/agentfabric/policy-group/_list.md
@@ -0,0 +1,22 @@
+# [Command] _agentfabric policy-group list_
+
+List independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resources. Policy Groups are not children of an Agent Fabric.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBz/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/providers/microsoft.networksecurity/policygroups 2026-07-21-preview -->
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups 2026-07-21-preview -->
+
+#### examples
+
+- PolicyGroups_ListBySubscription
+    ```bash
+        agentfabric policy-group list
+    ```
+
+- PolicyGroups_ListByResourceGroup
+    ```bash
+        agentfabric policy-group list --resource-group rgnetworksecurity
+    ```
diff --git a/Commands/agentfabric/policy-group/_show.md b/Commands/agentfabric/policy-group/_show.md
new file mode 100644
index 000000000..1e3841ba2
--- /dev/null
+++ b/Commands/agentfabric/policy-group/_show.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric policy-group show_
+
+Show an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{} 2026-07-21-preview -->
+
+#### examples
+
+- PolicyGroups_Get
+    ```bash
+        agentfabric policy-group show --resource-group rgnetworksecurity --name testPolicyGroup
+    ```
diff --git a/Commands/agentfabric/policy-group/_update.md b/Commands/agentfabric/policy-group/_update.md
new file mode 100644
index 000000000..ec1972dd0
--- /dev/null
+++ b/Commands/agentfabric/policy-group/_update.md
@@ -0,0 +1,16 @@
+# [Command] _agentfabric policy-group update_
+
+Update an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
+
+## Versions
+
+### [2026-07-21-preview](/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.xml) **Stable**
+
+<!-- mgmt-plane /subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{} 2026-07-21-preview -->
+
+#### examples
+
+- PolicyGroups_Update
+    ```bash
+        agentfabric policy-group update --resource-group rgnetworksecurity --name testPolicyGroup --tags "{env:production}"
+    ```
diff --git a/Commands/agentfabric/policy-group/readme.md b/Commands/agentfabric/policy-group/readme.md
new file mode 100644
index 000000000..8fef80f7b
--- /dev/null
+++ b/Commands/agentfabric/policy-group/readme.md
@@ -0,0 +1,20 @@
+# [Group] _agentfabric policy-group_
+
+Manage independent resource-group-scoped Microsoft.NetworkSecurity Policy Group peer resources. Policy Groups are not children of an Agent Fabric.
+
+## Commands
+
+- [create](/Commands/agentfabric/policy-group/_create.md)
+: Create an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
+
+- [delete](/Commands/agentfabric/policy-group/_delete.md)
+: Delete an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
+
+- [list](/Commands/agentfabric/policy-group/_list.md)
+: List independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resources. Policy Groups are not children of an Agent Fabric.
+
+- [show](/Commands/agentfabric/policy-group/_show.md)
+: Show an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
+
+- [update](/Commands/agentfabric/policy-group/_update.md)
+: Update an independent resource-group-scoped Microsoft.NetworkSecurity Policy Group resource. Policy Groups are not children of an Agent Fabric.
diff --git a/Commands/agentfabric/readme.md b/Commands/agentfabric/readme.md
new file mode 100644
index 000000000..f9431b730
--- /dev/null
+++ b/Commands/agentfabric/readme.md
@@ -0,0 +1,31 @@
+# [Group] _agentfabric_
+
+Manage Agent Fabric and related Microsoft.NetworkSecurity resources. Root commands manage Agent Fabric resources.
+
+## Subgroups
+
+- [aks](/Commands/agentfabric/aks/readme.md)
+: Manage AKS cluster enrollment with an Agent Fabric. Commands use the AKS cluster name as the association child name and require the parent Fabric name.
+
+- [member](/Commands/agentfabric/member/readme.md)
+: Manage members that are children of an Agent Fabric. The parent Fabric name is required.
+
+- [policy-group](/Commands/agentfabric/policy-group/readme.md)
+: Manage independent resource-group-scoped Microsoft.NetworkSecurity Policy Group peer resources. Policy Groups are not children of an Agent Fabric.
+
+## Commands
+
+- [create](/Commands/agentfabric/_create.md)
+: Create an Agent Fabric resource.
+
+- [delete](/Commands/agentfabric/_delete.md)
+: Delete an Agent Fabric resource.
+
+- [list](/Commands/agentfabric/_list.md)
+: List Agent Fabric resources.
+
+- [show](/Commands/agentfabric/_show.md)
+: Show an Agent Fabric resource.
+
+- [update](/Commands/agentfabric/_update.md)
+: Update an Agent Fabric resource.
diff --git a/Commands/readme.md b/Commands/readme.md
index 58bcf95e0..eec4f7a0c 100644
--- a/Commands/readme.md
+++ b/Commands/readme.md
@@ -11,6 +11,9 @@
 - [afd](/Commands/afd/readme.md)
 : Manage Azure Front Door Standard/Premium.
 
+- [agentfabric](/Commands/agentfabric/readme.md)
+: Manage Agent Fabric and related Microsoft.NetworkSecurity resources. Root commands manage Agent Fabric resources.
+
 - [alerts-management](/Commands/alerts-management/readme.md)
 : Manage Azure Alerts Management Service Resource.
 
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNz/2026-07-21-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNz/2026-07-21-preview.json
new file mode 100644
index 000000000..443c6c1d0
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNz/2026-07-21-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/providers/microsoft.networksecurity/agentfabrics", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9hZ2VudEZhYnJpY3M=/V/MjAyNi0wNy0yMS1wcmV2aWV3"}, {"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric", "commands": [{"name": "list", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/providers/microsoft.networksecurity/agentfabrics", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9hZ2VudEZhYnJpY3M=/V/MjAyNi0wNy0yMS1wcmV2aWV3"}, {"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "conditions": [{"var": "$Condition_AgentFabrics_ListBySubscription", "operator": {"type": "and", "operators": [{"type": "hasValue", "arg": "$Path.subscriptionId"}, {"type": "not", "operator": {"type": "hasValue", "arg": "$Path.resourceGroupName"}}]}}, {"var": "$Condition_AgentFabrics_ListByResourceGroup", "operator": {"type": "and", "operators": [{"type": "hasValue", "arg": "$Path.resourceGroupName"}, {"type": "hasValue", "arg": "$Path.subscriptionId"}]}}], "operations": [{"when": ["$Condition_AgentFabrics_ListBySubscription"], "operationId": "AgentFabrics_ListBySubscription", "http": {"path": "/subscriptions/{subscriptionId}/providers/Microsoft.NetworkSecurity/agentFabrics", "request": {"method": "get", "path": {"params": [{"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"type": "string", "name": "nextLink"}, {"type": "array<object>", "name": "value", "required": true, "item": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "array<ResourceId>", "name": "defaultPolicyGroups", "item": {"type": "ResourceId"}}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "trustDomain", "format": {"pattern": "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", "maxLength": 253}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}, {"when": ["$Condition_AgentFabrics_ListByResourceGroup"], "operationId": "AgentFabrics_ListByResourceGroup", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"type": "string", "name": "nextLink"}, {"type": "array<object>", "name": "value", "required": true, "item": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "array<ResourceId>", "name": "defaultPolicyGroups", "item": {"type": "ResourceId"}}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "trustDomain", "format": {"pattern": "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", "maxLength": 253}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "array", "ref": "$Instance.value", "clientFlatten": true, "nextLink": "$Instance.nextLink"}]}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNz/2026-07-21-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNz/2026-07-21-preview.xml
new file mode 100644
index 000000000..73fa357bc
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNz/2026-07-21-preview.xml
@@ -0,0 +1,215 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/providers/microsoft.networksecurity/agentfabrics" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9hZ2VudEZhYnJpY3M=/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <commandGroup name="agentfabric">
+    <command name="list" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/providers/microsoft.networksecurity/agentfabrics" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9hZ2VudEZhYnJpY3M=/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <condition var="$Condition_AgentFabrics_ListBySubscription">
+        <operator type="and">
+          <operator type="hasValue" arg="$Path.subscriptionId"/>
+          <operator type="not">
+            <operator type="hasValue" arg="$Path.resourceGroupName"/>
+          </operator>
+        </operator>
+      </condition>
+      <condition var="$Condition_AgentFabrics_ListByResourceGroup">
+        <operator type="and">
+          <operator type="hasValue" arg="$Path.resourceGroupName"/>
+          <operator type="hasValue" arg="$Path.subscriptionId"/>
+        </operator>
+      </condition>
+      <operation when="$Condition_AgentFabrics_ListBySubscription" operationId="AgentFabrics_ListBySubscription">
+        <http path="/subscriptions/{subscriptionId}/providers/Microsoft.NetworkSecurity/agentFabrics">
+          <request method="get">
+            <path>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop type="string" name="nextLink"/>
+                  <prop type="array<object>" name="value" required="True">
+                    <item type="object">
+                      <prop readOnly="True" type="ResourceId" name="id">
+                        <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"/>
+                      </prop>
+                      <prop type="ResourceLocation" name="location" required="True"/>
+                      <prop readOnly="True" type="string" name="name"/>
+                      <prop type="object" name="properties">
+                        <prop type="array<ResourceId>" name="defaultPolicyGroups">
+                          <item type="ResourceId"/>
+                        </prop>
+                        <prop readOnly="True" type="string" name="provisioningState">
+                          <enum>
+                            <item value="&quot;Accepted&quot;"/>
+                            <item value="&quot;Canceled&quot;"/>
+                            <item value="&quot;Deleting&quot;"/>
+                            <item value="&quot;Failed&quot;"/>
+                            <item value="&quot;Provisioning&quot;"/>
+                            <item value="&quot;Succeeded&quot;"/>
+                            <item value="&quot;Updating&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="string" name="trustDomain">
+                          <format pattern="^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" maxLength="253"/>
+                        </prop>
+                      </prop>
+                      <prop readOnly="True" type="object" name="systemData">
+                        <prop type="dateTime" name="createdAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="createdBy"/>
+                        <prop type="string" name="createdByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="dateTime" name="lastModifiedAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="lastModifiedBy"/>
+                        <prop type="string" name="lastModifiedByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop type="object" name="tags">
+                        <additionalProp>
+                          <item type="string"/>
+                        </additionalProp>
+                      </prop>
+                      <prop readOnly="True" type="string" name="type"/>
+                    </item>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <operation when="$Condition_AgentFabrics_ListByResourceGroup" operationId="AgentFabrics_ListByResourceGroup">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics">
+          <request method="get">
+            <path>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop type="string" name="nextLink"/>
+                  <prop type="array<object>" name="value" required="True">
+                    <item type="object">
+                      <prop readOnly="True" type="ResourceId" name="id">
+                        <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"/>
+                      </prop>
+                      <prop type="ResourceLocation" name="location" required="True"/>
+                      <prop readOnly="True" type="string" name="name"/>
+                      <prop type="object" name="properties">
+                        <prop type="array<ResourceId>" name="defaultPolicyGroups">
+                          <item type="ResourceId"/>
+                        </prop>
+                        <prop readOnly="True" type="string" name="provisioningState">
+                          <enum>
+                            <item value="&quot;Accepted&quot;"/>
+                            <item value="&quot;Canceled&quot;"/>
+                            <item value="&quot;Deleting&quot;"/>
+                            <item value="&quot;Failed&quot;"/>
+                            <item value="&quot;Provisioning&quot;"/>
+                            <item value="&quot;Succeeded&quot;"/>
+                            <item value="&quot;Updating&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="string" name="trustDomain">
+                          <format pattern="^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" maxLength="253"/>
+                        </prop>
+                      </prop>
+                      <prop readOnly="True" type="object" name="systemData">
+                        <prop type="dateTime" name="createdAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="createdBy"/>
+                        <prop type="string" name="createdByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="dateTime" name="lastModifiedAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="lastModifiedBy"/>
+                        <prop type="string" name="lastModifiedByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop type="object" name="tags">
+                        <additionalProp>
+                          <item type="string"/>
+                        </additionalProp>
+                      </prop>
+                      <prop readOnly="True" type="string" name="type"/>
+                    </item>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="array" ref="$Instance.value" clientFlatten="True" nextLink="$Instance.nextLink"/>
+    </command>
+  </commandGroup>
+</CodeGen>
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBz/2026-07-21-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBz/2026-07-21-preview.json
new file mode 100644
index 000000000..9b9aaf811
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBz/2026-07-21-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/providers/microsoft.networksecurity/policygroups", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9wb2xpY3lHcm91cHM=/V/MjAyNi0wNy0yMS1wcmV2aWV3"}, {"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric policy-group", "commands": [{"name": "list", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/providers/microsoft.networksecurity/policygroups", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9wb2xpY3lHcm91cHM=/V/MjAyNi0wNy0yMS1wcmV2aWV3"}, {"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "conditions": [{"var": "$Condition_PolicyGroups_ListBySubscription", "operator": {"type": "and", "operators": [{"type": "hasValue", "arg": "$Path.subscriptionId"}, {"type": "not", "operator": {"type": "hasValue", "arg": "$Path.resourceGroupName"}}]}}, {"var": "$Condition_PolicyGroups_ListByResourceGroup", "operator": {"type": "and", "operators": [{"type": "hasValue", "arg": "$Path.resourceGroupName"}, {"type": "hasValue", "arg": "$Path.subscriptionId"}]}}], "operations": [{"when": ["$Condition_PolicyGroups_ListBySubscription"], "operationId": "PolicyGroups_ListBySubscription", "http": {"path": "/subscriptions/{subscriptionId}/providers/Microsoft.NetworkSecurity/policyGroups", "request": {"method": "get", "path": {"params": [{"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"type": "string", "name": "nextLink"}, {"type": "array<object>", "name": "value", "required": true, "item": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "string", "name": "description"}, {"type": "string", "name": "displayName"}, {"type": "array<object>", "name": "networkSecurityPolicies", "item": {"type": "object", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ContentInspection"}, {"value": "FqdnFiltering"}, {"value": "Mcp"}, {"value": "TlsInspection"}, {"value": "UrlFiltering"}]}}], "discriminators": [{"property": "type", "value": "ContentInspection", "props": [{"type": "object", "name": "promptInjectionProtection", "props": [{"type": "string", "name": "onDetection", "required": true, "enum": {"items": [{"value": "Alert"}, {"value": "BlockAndAlert"}, {"value": "Sanitize"}]}}, {"type": "array<string>", "name": "promptLocations", "item": {"type": "string"}}, {"type": "array<string>", "name": "responseLocations", "item": {"type": "string"}}, {"type": "string", "name": "sensitivity", "enum": {"items": [{"value": "High"}, {"value": "Low"}, {"value": "Medium"}]}}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "FqdnFiltering", "props": [{"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "Fqdns"}]}}], "discriminators": [{"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}]}, {"type": "string", "name": "direction", "enum": {"items": [{"value": "Both"}, {"value": "Inbound"}, {"value": "Outbound"}]}}, {"type": "string", "name": "name"}, {"type": "array<integer32>", "name": "ports", "item": {"type": "integer32"}}, {"type": "integer32", "name": "priority"}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "Mcp", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "array<string>", "name": "tools", "required": true, "item": {"type": "string"}}]}}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "TlsInspection", "props": [{"type": "object", "name": "certificate", "required": true, "props": [{"type": "string", "name": "mode", "required": true, "enum": {"items": [{"value": "AzureManagedCA"}]}}], "discriminators": [{"property": "mode", "value": "AzureManagedCA"}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "UrlFiltering", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "string", "name": "hostname"}, {"type": "string", "name": "method", "enum": {"items": [{"value": "DELETE"}, {"value": "GET"}, {"value": "HEAD"}, {"value": "OPTIONS"}, {"value": "PATCH"}, {"value": "POST"}, {"value": "PUT"}]}}, {"type": "string", "name": "name", "required": true}, {"type": "array<string>", "name": "paths", "item": {"type": "string"}}, {"type": "integer32", "name": "priority", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}]}}, {"type": "integer32", "name": "priority"}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}, {"when": ["$Condition_PolicyGroups_ListByResourceGroup"], "operationId": "PolicyGroups_ListByResourceGroup", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"type": "string", "name": "nextLink"}, {"type": "array<object>", "name": "value", "required": true, "item": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "string", "name": "description"}, {"type": "string", "name": "displayName"}, {"type": "array<object>", "name": "networkSecurityPolicies", "item": {"type": "object", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ContentInspection"}, {"value": "FqdnFiltering"}, {"value": "Mcp"}, {"value": "TlsInspection"}, {"value": "UrlFiltering"}]}}], "discriminators": [{"property": "type", "value": "ContentInspection", "props": [{"type": "object", "name": "promptInjectionProtection", "props": [{"type": "string", "name": "onDetection", "required": true, "enum": {"items": [{"value": "Alert"}, {"value": "BlockAndAlert"}, {"value": "Sanitize"}]}}, {"type": "array<string>", "name": "promptLocations", "item": {"type": "string"}}, {"type": "array<string>", "name": "responseLocations", "item": {"type": "string"}}, {"type": "string", "name": "sensitivity", "enum": {"items": [{"value": "High"}, {"value": "Low"}, {"value": "Medium"}]}}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "FqdnFiltering", "props": [{"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "Fqdns"}]}}], "discriminators": [{"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}]}, {"type": "string", "name": "direction", "enum": {"items": [{"value": "Both"}, {"value": "Inbound"}, {"value": "Outbound"}]}}, {"type": "string", "name": "name"}, {"type": "array<integer32>", "name": "ports", "item": {"type": "integer32"}}, {"type": "integer32", "name": "priority"}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "Mcp", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "array<string>", "name": "tools", "required": true, "item": {"type": "string"}}]}}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "TlsInspection", "props": [{"type": "object", "name": "certificate", "required": true, "props": [{"type": "string", "name": "mode", "required": true, "enum": {"items": [{"value": "AzureManagedCA"}]}}], "discriminators": [{"property": "mode", "value": "AzureManagedCA"}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "UrlFiltering", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "string", "name": "hostname"}, {"type": "string", "name": "method", "enum": {"items": [{"value": "DELETE"}, {"value": "GET"}, {"value": "HEAD"}, {"value": "OPTIONS"}, {"value": "PATCH"}, {"value": "POST"}, {"value": "PUT"}]}}, {"type": "string", "name": "name", "required": true}, {"type": "array<string>", "name": "paths", "item": {"type": "string"}}, {"type": "integer32", "name": "priority", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}]}}, {"type": "integer32", "name": "priority"}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "array", "ref": "$Instance.value", "clientFlatten": true, "nextLink": "$Instance.nextLink"}]}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBz/2026-07-21-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBz/2026-07-21-preview.xml
new file mode 100644
index 000000000..00f466bc8
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBz/2026-07-21-preview.xml
@@ -0,0 +1,731 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/providers/microsoft.networksecurity/policygroups" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9wb2xpY3lHcm91cHM=/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <commandGroup name="agentfabric policy-group">
+    <command name="list" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/providers/microsoft.networksecurity/policygroups" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9wcm92aWRlcnMvTWljcm9zb2Z0Lk5ldHdvcmtTZWN1cml0eS9wb2xpY3lHcm91cHM=/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcw==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <condition var="$Condition_PolicyGroups_ListBySubscription">
+        <operator type="and">
+          <operator type="hasValue" arg="$Path.subscriptionId"/>
+          <operator type="not">
+            <operator type="hasValue" arg="$Path.resourceGroupName"/>
+          </operator>
+        </operator>
+      </condition>
+      <condition var="$Condition_PolicyGroups_ListByResourceGroup">
+        <operator type="and">
+          <operator type="hasValue" arg="$Path.resourceGroupName"/>
+          <operator type="hasValue" arg="$Path.subscriptionId"/>
+        </operator>
+      </condition>
+      <operation when="$Condition_PolicyGroups_ListBySubscription" operationId="PolicyGroups_ListBySubscription">
+        <http path="/subscriptions/{subscriptionId}/providers/Microsoft.NetworkSecurity/policyGroups">
+          <request method="get">
+            <path>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop type="string" name="nextLink"/>
+                  <prop type="array<object>" name="value" required="True">
+                    <item type="object">
+                      <prop readOnly="True" type="ResourceId" name="id">
+                        <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"/>
+                      </prop>
+                      <prop type="ResourceLocation" name="location" required="True"/>
+                      <prop readOnly="True" type="string" name="name"/>
+                      <prop type="object" name="properties">
+                        <prop type="string" name="description"/>
+                        <prop type="string" name="displayName"/>
+                        <prop type="array<object>" name="networkSecurityPolicies">
+                          <item type="object">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;ContentInspection&quot;"/>
+                                <item value="&quot;FqdnFiltering&quot;"/>
+                                <item value="&quot;Mcp&quot;"/>
+                                <item value="&quot;TlsInspection&quot;"/>
+                                <item value="&quot;UrlFiltering&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="ContentInspection">
+                              <prop type="object" name="promptInjectionProtection">
+                                <prop type="string" name="onDetection" required="True">
+                                  <enum>
+                                    <item value="&quot;Alert&quot;"/>
+                                    <item value="&quot;BlockAndAlert&quot;"/>
+                                    <item value="&quot;Sanitize&quot;"/>
+                                  </enum>
+                                </prop>
+                                <prop type="array<string>" name="promptLocations">
+                                  <item type="string"/>
+                                </prop>
+                                <prop type="array<string>" name="responseLocations">
+                                  <item type="string"/>
+                                </prop>
+                                <prop type="string" name="sensitivity">
+                                  <enum>
+                                    <item value="&quot;High&quot;"/>
+                                    <item value="&quot;Low&quot;"/>
+                                    <item value="&quot;Medium&quot;"/>
+                                  </enum>
+                                </prop>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="FqdnFiltering">
+                              <prop type="object" name="destination">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;Fqdns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="Fqdns">
+                                  <prop type="array<string>" name="fqdns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                              <prop type="string" name="direction">
+                                <enum>
+                                  <item value="&quot;Both&quot;"/>
+                                  <item value="&quot;Inbound&quot;"/>
+                                  <item value="&quot;Outbound&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="name"/>
+                              <prop type="array<integer32>" name="ports">
+                                <item type="integer32"/>
+                              </prop>
+                              <prop type="integer32" name="priority"/>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Mcp">
+                              <prop type="string" name="defaultAction" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="object" name="destination" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;Fqdns&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="Fqdns">
+                                  <prop type="array<string>" name="fqdns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                              <prop type="array<object>" name="rules" required="True">
+                                <item type="object">
+                                  <prop type="string" name="action" required="True">
+                                    <enum>
+                                      <item value="&quot;Allow&quot;"/>
+                                      <item value="&quot;Deny&quot;"/>
+                                    </enum>
+                                  </prop>
+                                  <prop type="array<string>" name="tools" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </item>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="TlsInspection">
+                              <prop type="object" name="certificate" required="True">
+                                <prop type="string" name="mode" required="True">
+                                  <enum>
+                                    <item value="&quot;AzureManagedCA&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="mode" value="AzureManagedCA"/>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="UrlFiltering">
+                              <prop type="string" name="defaultAction" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="object" name="destination">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;Fqdns&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="Fqdns">
+                                  <prop type="array<string>" name="fqdns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                              <prop type="array<object>" name="rules" required="True" identifiers="name">
+                                <item type="object">
+                                  <prop type="string" name="action" required="True">
+                                    <enum>
+                                      <item value="&quot;Allow&quot;"/>
+                                      <item value="&quot;Deny&quot;"/>
+                                    </enum>
+                                  </prop>
+                                  <prop type="string" name="hostname"/>
+                                  <prop type="string" name="method">
+                                    <enum>
+                                      <item value="&quot;DELETE&quot;"/>
+                                      <item value="&quot;GET&quot;"/>
+                                      <item value="&quot;HEAD&quot;"/>
+                                      <item value="&quot;OPTIONS&quot;"/>
+                                      <item value="&quot;PATCH&quot;"/>
+                                      <item value="&quot;POST&quot;"/>
+                                      <item value="&quot;PUT&quot;"/>
+                                    </enum>
+                                  </prop>
+                                  <prop type="string" name="name" required="True"/>
+                                  <prop type="array<string>" name="paths">
+                                    <item type="string"/>
+                                  </prop>
+                                  <prop type="integer32" name="priority" required="True"/>
+                                </item>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                          </item>
+                        </prop>
+                        <prop type="integer32" name="priority"/>
+                        <prop readOnly="True" type="string" name="provisioningState">
+                          <enum>
+                            <item value="&quot;Accepted&quot;"/>
+                            <item value="&quot;Canceled&quot;"/>
+                            <item value="&quot;Deleting&quot;"/>
+                            <item value="&quot;Failed&quot;"/>
+                            <item value="&quot;Provisioning&quot;"/>
+                            <item value="&quot;Succeeded&quot;"/>
+                            <item value="&quot;Updating&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop readOnly="True" type="object" name="systemData">
+                        <prop type="dateTime" name="createdAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="createdBy"/>
+                        <prop type="string" name="createdByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="dateTime" name="lastModifiedAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="lastModifiedBy"/>
+                        <prop type="string" name="lastModifiedByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop type="object" name="tags">
+                        <additionalProp>
+                          <item type="string"/>
+                        </additionalProp>
+                      </prop>
+                      <prop readOnly="True" type="string" name="type"/>
+                    </item>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <operation when="$Condition_PolicyGroups_ListByResourceGroup" operationId="PolicyGroups_ListByResourceGroup">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups">
+          <request method="get">
+            <path>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop type="string" name="nextLink"/>
+                  <prop type="array<object>" name="value" required="True">
+                    <item type="object">
+                      <prop readOnly="True" type="ResourceId" name="id">
+                        <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"/>
+                      </prop>
+                      <prop type="ResourceLocation" name="location" required="True"/>
+                      <prop readOnly="True" type="string" name="name"/>
+                      <prop type="object" name="properties">
+                        <prop type="string" name="description"/>
+                        <prop type="string" name="displayName"/>
+                        <prop type="array<object>" name="networkSecurityPolicies">
+                          <item type="object">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;ContentInspection&quot;"/>
+                                <item value="&quot;FqdnFiltering&quot;"/>
+                                <item value="&quot;Mcp&quot;"/>
+                                <item value="&quot;TlsInspection&quot;"/>
+                                <item value="&quot;UrlFiltering&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="ContentInspection">
+                              <prop type="object" name="promptInjectionProtection">
+                                <prop type="string" name="onDetection" required="True">
+                                  <enum>
+                                    <item value="&quot;Alert&quot;"/>
+                                    <item value="&quot;BlockAndAlert&quot;"/>
+                                    <item value="&quot;Sanitize&quot;"/>
+                                  </enum>
+                                </prop>
+                                <prop type="array<string>" name="promptLocations">
+                                  <item type="string"/>
+                                </prop>
+                                <prop type="array<string>" name="responseLocations">
+                                  <item type="string"/>
+                                </prop>
+                                <prop type="string" name="sensitivity">
+                                  <enum>
+                                    <item value="&quot;High&quot;"/>
+                                    <item value="&quot;Low&quot;"/>
+                                    <item value="&quot;Medium&quot;"/>
+                                  </enum>
+                                </prop>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="FqdnFiltering">
+                              <prop type="object" name="destination">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;Fqdns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="Fqdns">
+                                  <prop type="array<string>" name="fqdns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                              <prop type="string" name="direction">
+                                <enum>
+                                  <item value="&quot;Both&quot;"/>
+                                  <item value="&quot;Inbound&quot;"/>
+                                  <item value="&quot;Outbound&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="name"/>
+                              <prop type="array<integer32>" name="ports">
+                                <item type="integer32"/>
+                              </prop>
+                              <prop type="integer32" name="priority"/>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Mcp">
+                              <prop type="string" name="defaultAction" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="object" name="destination" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;Fqdns&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="Fqdns">
+                                  <prop type="array<string>" name="fqdns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                              <prop type="array<object>" name="rules" required="True">
+                                <item type="object">
+                                  <prop type="string" name="action" required="True">
+                                    <enum>
+                                      <item value="&quot;Allow&quot;"/>
+                                      <item value="&quot;Deny&quot;"/>
+                                    </enum>
+                                  </prop>
+                                  <prop type="array<string>" name="tools" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </item>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="TlsInspection">
+                              <prop type="object" name="certificate" required="True">
+                                <prop type="string" name="mode" required="True">
+                                  <enum>
+                                    <item value="&quot;AzureManagedCA&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="mode" value="AzureManagedCA"/>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="UrlFiltering">
+                              <prop type="string" name="defaultAction" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="object" name="destination">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;Fqdns&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="Fqdns">
+                                  <prop type="array<string>" name="fqdns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                              <prop type="array<object>" name="rules" required="True" identifiers="name">
+                                <item type="object">
+                                  <prop type="string" name="action" required="True">
+                                    <enum>
+                                      <item value="&quot;Allow&quot;"/>
+                                      <item value="&quot;Deny&quot;"/>
+                                    </enum>
+                                  </prop>
+                                  <prop type="string" name="hostname"/>
+                                  <prop type="string" name="method">
+                                    <enum>
+                                      <item value="&quot;DELETE&quot;"/>
+                                      <item value="&quot;GET&quot;"/>
+                                      <item value="&quot;HEAD&quot;"/>
+                                      <item value="&quot;OPTIONS&quot;"/>
+                                      <item value="&quot;PATCH&quot;"/>
+                                      <item value="&quot;POST&quot;"/>
+                                      <item value="&quot;PUT&quot;"/>
+                                    </enum>
+                                  </prop>
+                                  <prop type="string" name="name" required="True"/>
+                                  <prop type="array<string>" name="paths">
+                                    <item type="string"/>
+                                  </prop>
+                                  <prop type="integer32" name="priority" required="True"/>
+                                </item>
+                              </prop>
+                              <prop type="object" name="source" required="True">
+                                <prop type="string" name="type" required="True">
+                                  <enum>
+                                    <item value="&quot;AddressPrefixes&quot;"/>
+                                    <item value="&quot;WorkloadIdPatterns&quot;"/>
+                                  </enum>
+                                </prop>
+                                <discriminator property="type" value="AddressPrefixes">
+                                  <prop type="array<string>" name="prefixes" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                                <discriminator property="type" value="WorkloadIdPatterns">
+                                  <prop type="array<string>" name="patterns" required="True">
+                                    <item type="string"/>
+                                  </prop>
+                                </discriminator>
+                              </prop>
+                            </discriminator>
+                          </item>
+                        </prop>
+                        <prop type="integer32" name="priority"/>
+                        <prop readOnly="True" type="string" name="provisioningState">
+                          <enum>
+                            <item value="&quot;Accepted&quot;"/>
+                            <item value="&quot;Canceled&quot;"/>
+                            <item value="&quot;Deleting&quot;"/>
+                            <item value="&quot;Failed&quot;"/>
+                            <item value="&quot;Provisioning&quot;"/>
+                            <item value="&quot;Succeeded&quot;"/>
+                            <item value="&quot;Updating&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop readOnly="True" type="object" name="systemData">
+                        <prop type="dateTime" name="createdAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="createdBy"/>
+                        <prop type="string" name="createdByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="dateTime" name="lastModifiedAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="lastModifiedBy"/>
+                        <prop type="string" name="lastModifiedByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop type="object" name="tags">
+                        <additionalProp>
+                          <item type="string"/>
+                        </additionalProp>
+                      </prop>
+                      <prop readOnly="True" type="string" name="type"/>
+                    </item>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="array" ref="$Instance.value" clientFlatten="True" nextLink="$Instance.nextLink"/>
+    </command>
+  </commandGroup>
+</CodeGen>
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.json
new file mode 100644
index 000000000..00721e848
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric", "commands": [{"name": "create", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"type": "array<ResourceId>", "var": "$resource.properties.defaultPolicyGroups", "options": ["default-policy-groups"], "group": "Properties", "help": {"short": "The default policy groups to apply to all members of this fabric."}, "item": {"type": "ResourceId"}}, {"type": "string", "var": "$resource.properties.trustDomain", "options": ["trust-domain"], "group": "Properties", "help": {"short": "The trust domain that scopes this fabric's member identities. It is the leading component of each member's identity, which takes the form `<trustDomain>/<agentFabricName>/<memberName>`. Set at creation and immutable thereafter; when omitted, the shared default trust domain `microsoft.agentfabric` is used."}, "format": {"pattern": "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", "maxLength": 253}}]}, {"name": "Resource", "args": [{"type": "ResourceLocation", "var": "$resource.location", "options": ["l", "location"], "required": true, "group": "Resource", "help": {"short": "The geo-location where the resource lives"}}, {"type": "object", "var": "$resource.tags", "options": ["tags"], "group": "Resource", "help": {"short": "Resource tags."}, "additionalProps": {"item": {"type": "string"}}}]}], "operations": [{"longRunning": {"finalStateVia": "azure-async-operation"}, "operationId": "AgentFabrics_CreateOrUpdate", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}", "request": {"method": "put", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"schema": {"type": "object", "name": "resource", "required": true, "props": [{"type": "ResourceLocation", "name": "location", "arg": "$resource.location", "required": true}, {"type": "object", "name": "properties", "props": [{"type": "array<ResourceId>", "name": "defaultPolicyGroups", "arg": "$resource.properties.defaultPolicyGroups", "item": {"type": "ResourceId"}}, {"type": "string", "name": "trustDomain", "arg": "$resource.properties.trustDomain", "format": {"pattern": "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", "maxLength": 253}}]}, {"type": "object", "name": "tags", "arg": "$resource.tags", "additionalProps": {"item": {"type": "string"}}}], "clientFlatten": true}}}}, "responses": [{"statusCode": [200, 201], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "array<ResourceId>", "name": "defaultPolicyGroups", "item": {"type": "ResourceId"}}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "trustDomain", "format": {"pattern": "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", "maxLength": 253}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "show", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"operationId": "AgentFabrics_Get", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "array<ResourceId>", "name": "defaultPolicyGroups", "item": {"type": "ResourceId"}}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "trustDomain", "format": {"pattern": "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", "maxLength": 253}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "update", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"type": "object", "var": "$properties.tags", "options": ["tags"], "group": "Properties", "help": {"short": "Resource tags."}, "additionalProps": {"item": {"type": "string"}}}]}], "operations": [{"longRunning": {"finalStateVia": "location"}, "operationId": "AgentFabrics_Update", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}", "request": {"method": "patch", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"schema": {"type": "object", "name": "properties", "required": true, "props": [{"type": "object", "name": "tags", "arg": "$properties.tags", "additionalProps": {"item": {"type": "string"}}}], "clientFlatten": true}}}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "array<ResourceId>", "name": "defaultPolicyGroups", "item": {"type": "ResourceId"}}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "trustDomain", "format": {"pattern": "^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$", "maxLength": 253}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"statusCode": [202], "header": {"items": [{"name": "Location"}, {"name": "Retry-After"}]}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "delete", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"longRunning": {"finalStateVia": "location"}, "operationId": "AgentFabrics_Delete", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}", "request": {"method": "delete", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [202], "header": {"items": [{"name": "Azure-AsyncOperation"}, {"name": "Location"}, {"name": "Retry-After"}]}}, {"statusCode": [204]}, {"statusCode": [200, 201]}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "confirmation": "Are you sure you want to perform this operation?"}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.xml
new file mode 100644
index 000000000..375bb0016
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9/2026-07-21-preview.xml
@@ -0,0 +1,435 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <commandGroup name="agentfabric">
+    <command name="create" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="name n" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg type="array<ResourceId>" var="$resource.properties.defaultPolicyGroups" options="default-policy-groups" group="Properties">
+          <help short="The default policy groups to apply to all members of this fabric."/>
+          <item type="ResourceId"/>
+        </arg>
+        <arg type="string" var="$resource.properties.trustDomain" options="trust-domain" group="Properties">
+          <help short="The trust domain that scopes this fabric's member identities. It is the leading component of each member's identity, which takes the form `<trustDomain>/<agentFabricName>/<memberName>`. Set at creation and immutable thereafter; when omitted, the shared default trust domain `microsoft.agentfabric` is used."/>
+          <format pattern="^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" maxLength="253"/>
+        </arg>
+      </argGroup>
+      <argGroup name="Resource">
+        <arg type="ResourceLocation" var="$resource.location" options="location l" required="True" group="Resource">
+          <help short="The geo-location where the resource lives"/>
+        </arg>
+        <arg type="object" var="$resource.tags" options="tags" group="Resource">
+          <help short="Resource tags."/>
+          <additionalProp>
+            <item type="string"/>
+          </additionalProp>
+        </arg>
+      </argGroup>
+      <operation operationId="AgentFabrics_CreateOrUpdate">
+        <longRunning finalStateVia="azure-async-operation"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}">
+          <request method="put">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json>
+                <schema type="object" name="resource" required="True" clientFlatten="True">
+                  <prop type="ResourceLocation" name="location" arg="$resource.location" required="True"/>
+                  <prop type="object" name="properties">
+                    <prop type="array<ResourceId>" name="defaultPolicyGroups" arg="$resource.properties.defaultPolicyGroups">
+                      <item type="ResourceId"/>
+                    </prop>
+                    <prop type="string" name="trustDomain" arg="$resource.properties.trustDomain">
+                      <format pattern="^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" maxLength="253"/>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags" arg="$resource.tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </request>
+          <response statusCode="200 201">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="array<ResourceId>" name="defaultPolicyGroups">
+                      <item type="ResourceId"/>
+                    </prop>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="string" name="trustDomain">
+                      <format pattern="^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" maxLength="253"/>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="show" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="name n" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="AgentFabrics_Get">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}">
+          <request method="get">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="array<ResourceId>" name="defaultPolicyGroups">
+                      <item type="ResourceId"/>
+                    </prop>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="string" name="trustDomain">
+                      <format pattern="^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" maxLength="253"/>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="update" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="name n" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg type="object" var="$properties.tags" options="tags" group="Properties">
+          <help short="Resource tags."/>
+          <additionalProp>
+            <item type="string"/>
+          </additionalProp>
+        </arg>
+      </argGroup>
+      <operation operationId="AgentFabrics_Update">
+        <longRunning finalStateVia="location"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}">
+          <request method="patch">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json>
+                <schema type="object" name="properties" required="True" clientFlatten="True">
+                  <prop type="object" name="tags" arg="$properties.tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="array<ResourceId>" name="defaultPolicyGroups">
+                      <item type="ResourceId"/>
+                    </prop>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="string" name="trustDomain">
+                      <format pattern="^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$" maxLength="253"/>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response statusCode="202">
+            <header>
+              <item name="Location"/>
+              <item name="Retry-After"/>
+            </header>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="delete" version="2026-07-21-preview" confirmation="Are you sure you want to perform this operation?">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="name n" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="AgentFabrics_Delete">
+        <longRunning finalStateVia="location"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}">
+          <request method="delete">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="202">
+            <header>
+              <item name="Azure-AsyncOperation"/>
+              <item name="Location"/>
+              <item name="Retry-After"/>
+            </header>
+          </response>
+          <response statusCode="204"/>
+          <response statusCode="200 201"/>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+    </command>
+  </commandGroup>
+</CodeGen>
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnM=/2026-07-21-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnM=/2026-07-21-preview.json
new file mode 100644
index 000000000..f9778bdee
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnM=/2026-07-21-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJz/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric member", "commands": [{"name": "list", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJz/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"operationId": "Members_ListByParent", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"type": "string", "name": "nextLink"}, {"type": "array<object>", "name": "value", "required": true, "item": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"readOnly": true, "type": "string", "name": "spiffeId"}, {"type": "object", "name": "workload", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ACI"}, {"value": "AgentFabricSandbox"}]}}, {"readOnly": true, "type": "string", "name": "workloadId"}], "discriminators": [{"property": "type", "value": "ACI", "props": [{"type": "ResourceId", "name": "resourceId", "required": true}]}, {"property": "type", "value": "AgentFabricSandbox", "props": [{"type": "object", "name": "agentIdentity", "props": [{"type": "string", "name": "agentId", "required": true}, {"type": "string", "name": "tenantId", "required": true}]}, {"type": "string", "name": "domain", "required": true}, {"type": "array<object>", "name": "endpoints", "item": {"type": "object", "props": [{"type": "string", "name": "name", "required": true}, {"type": "integer32", "name": "port", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "image", "required": true, "props": [{"type": "string", "name": "digest"}, {"type": "string", "name": "pullPolicy", "enum": {"items": [{"value": "Always"}, {"value": "IfNotPresent"}]}}, {"type": "string", "name": "uri", "required": true}]}, {"type": "object", "name": "resources", "required": true, "props": [{"type": "string", "name": "cpu", "required": true}, {"type": "string", "name": "disk"}, {"type": "string", "name": "memory", "required": true}]}]}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "array", "ref": "$Instance.value", "clientFlatten": true, "nextLink": "$Instance.nextLink"}]}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnM=/2026-07-21-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnM=/2026-07-21-preview.xml
new file mode 100644
index 000000000..e2621af7c
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnM=/2026-07-21-preview.xml
@@ -0,0 +1,150 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJz/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <commandGroup name="agentfabric member">
+    <command name="list" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJz/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="Members_ListByParent">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members">
+          <request method="get">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop type="string" name="nextLink"/>
+                  <prop type="array<object>" name="value" required="True">
+                    <item type="object">
+                      <prop readOnly="True" type="ResourceId" name="id">
+                        <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"/>
+                      </prop>
+                      <prop type="ResourceLocation" name="location" required="True"/>
+                      <prop readOnly="True" type="string" name="name"/>
+                      <prop type="object" name="properties">
+                        <prop readOnly="True" type="string" name="provisioningState">
+                          <enum>
+                            <item value="&quot;Accepted&quot;"/>
+                            <item value="&quot;Canceled&quot;"/>
+                            <item value="&quot;Deleting&quot;"/>
+                            <item value="&quot;Failed&quot;"/>
+                            <item value="&quot;Provisioning&quot;"/>
+                            <item value="&quot;Succeeded&quot;"/>
+                            <item value="&quot;Updating&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop readOnly="True" type="string" name="spiffeId"/>
+                        <prop type="object" name="workload">
+                          <prop type="string" name="type" required="True">
+                            <enum>
+                              <item value="&quot;ACI&quot;"/>
+                              <item value="&quot;AgentFabricSandbox&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop readOnly="True" type="string" name="workloadId"/>
+                          <discriminator property="type" value="ACI">
+                            <prop type="ResourceId" name="resourceId" required="True"/>
+                          </discriminator>
+                          <discriminator property="type" value="AgentFabricSandbox">
+                            <prop type="object" name="agentIdentity">
+                              <prop type="string" name="agentId" required="True"/>
+                              <prop type="string" name="tenantId" required="True"/>
+                            </prop>
+                            <prop type="string" name="domain" required="True"/>
+                            <prop type="array<object>" name="endpoints" identifiers="name">
+                              <item type="object">
+                                <prop type="string" name="name" required="True"/>
+                                <prop type="integer32" name="port" required="True"/>
+                              </item>
+                            </prop>
+                            <prop type="object" name="image" required="True">
+                              <prop type="string" name="digest"/>
+                              <prop type="string" name="pullPolicy">
+                                <enum>
+                                  <item value="&quot;Always&quot;"/>
+                                  <item value="&quot;IfNotPresent&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="uri" required="True"/>
+                            </prop>
+                            <prop type="object" name="resources" required="True">
+                              <prop type="string" name="cpu" required="True"/>
+                              <prop type="string" name="disk"/>
+                              <prop type="string" name="memory" required="True"/>
+                            </prop>
+                          </discriminator>
+                        </prop>
+                      </prop>
+                      <prop readOnly="True" type="object" name="systemData">
+                        <prop type="dateTime" name="createdAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="createdBy"/>
+                        <prop type="string" name="createdByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="dateTime" name="lastModifiedAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="lastModifiedBy"/>
+                        <prop type="string" name="lastModifiedByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop type="object" name="tags">
+                        <additionalProp>
+                          <item type="string"/>
+                        </additionalProp>
+                      </prop>
+                      <prop readOnly="True" type="string" name="type"/>
+                    </item>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="array" ref="$Instance.value" clientFlatten="True" nextLink="$Instance.nextLink"/>
+    </command>
+  </commandGroup>
+</CodeGen>
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.json
new file mode 100644
index 000000000..0acf4c368
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric member", "commands": [{"name": "show", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.memberName", "options": ["member-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the Member"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"operationId": "Members_Get", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "memberName", "arg": "$Path.memberName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"readOnly": true, "type": "string", "name": "spiffeId"}, {"type": "object", "name": "workload", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ACI"}, {"value": "AgentFabricSandbox"}]}}, {"readOnly": true, "type": "string", "name": "workloadId"}], "discriminators": [{"property": "type", "value": "ACI", "props": [{"type": "ResourceId", "name": "resourceId", "required": true}]}, {"property": "type", "value": "AgentFabricSandbox", "props": [{"type": "object", "name": "agentIdentity", "props": [{"type": "string", "name": "agentId", "required": true}, {"type": "string", "name": "tenantId", "required": true}]}, {"type": "string", "name": "domain", "required": true}, {"type": "array<object>", "name": "endpoints", "item": {"type": "object", "props": [{"type": "string", "name": "name", "required": true}, {"type": "integer32", "name": "port", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "image", "required": true, "props": [{"type": "string", "name": "digest"}, {"type": "string", "name": "pullPolicy", "enum": {"items": [{"value": "Always"}, {"value": "IfNotPresent"}]}}, {"type": "string", "name": "uri", "required": true}]}, {"type": "object", "name": "resources", "required": true, "props": [{"type": "string", "name": "cpu", "required": true}, {"type": "string", "name": "disk"}, {"type": "string", "name": "memory", "required": true}]}]}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "delete", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.memberName", "options": ["member-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the Member"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"longRunning": {"finalStateVia": "location"}, "operationId": "Members_Delete", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}", "request": {"method": "delete", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "memberName", "arg": "$Path.memberName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [202], "header": {"items": [{"name": "Azure-AsyncOperation"}, {"name": "Location"}, {"name": "Retry-After"}]}}, {"statusCode": [204]}, {"statusCode": [200, 201]}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "confirmation": "Are you sure you want to perform this operation?"}, {"name": "create", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.memberName", "options": ["member-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the Member"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"type": "object", "var": "$resource.properties.workload", "options": ["workload"], "group": "Properties", "help": {"short": "The workload configuration of the member. Set at creation and immutable thereafter; to change the workload, delete and recreate the member."}, "args": [{"type": "object", "var": "$resource.properties.workload.ACI", "options": ["aci"], "args": [{"type": "ResourceId", "var": "$resource.properties.workload.ACI.resourceId", "options": ["resource-id"], "required": true, "help": {"short": "The Azure Resource Manager resource ID of the Azure Container Instances (ACI) container group backing this member's sandbox."}}]}, {"type": "object", "var": "$resource.properties.workload.AgentFabricSandbox", "options": ["agent-fabric-sandbox"], "args": [{"type": "object", "var": "$resource.properties.workload.AgentFabricSandbox.agentIdentity", "options": ["agent-identity"], "help": {"short": "The Entra agent identity associated with the workload."}, "args": [{"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.agentIdentity.agentId", "options": ["agent-id"], "required": true, "help": {"short": "The Entra agent ID representing the workload's identity."}}, {"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.agentIdentity.tenantId", "options": ["tenant-id"], "required": true, "help": {"short": "The Azure tenant ID that owns the agent identity."}}]}, {"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.domain", "options": ["domain"], "required": true, "help": {"short": "The resolvable DNS name assigned to the workload."}}, {"type": "array<object>", "var": "$resource.properties.workload.AgentFabricSandbox.endpoints", "options": ["endpoints"], "help": {"short": "The network endpoints exposed by the workload."}, "item": {"type": "object", "args": [{"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.endpoints[].name", "options": ["name"], "required": true, "help": {"short": "The name of the endpoint."}}, {"type": "integer32", "var": "$resource.properties.workload.AgentFabricSandbox.endpoints[].port", "options": ["port"], "required": true, "help": {"short": "The port the endpoint listens on."}}]}}, {"type": "object", "var": "$resource.properties.workload.AgentFabricSandbox.image", "options": ["image"], "required": true, "help": {"short": "The container image to run for the workload."}, "args": [{"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.image.digest", "options": ["digest"], "help": {"short": "The image content digest used to pin an exact image version."}}, {"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.image.pullPolicy", "options": ["pull-policy"], "help": {"short": "The policy controlling when the image is pulled."}, "enum": {"items": [{"name": "Always", "value": "Always"}, {"name": "IfNotPresent", "value": "IfNotPresent"}]}}, {"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.image.uri", "options": ["uri"], "required": true, "help": {"short": "The image reference URI (e.g., registry/repository:tag)."}}]}, {"type": "object", "var": "$resource.properties.workload.AgentFabricSandbox.resources", "options": ["resources"], "required": true, "help": {"short": "The compute resources allocated to the workload."}, "args": [{"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.resources.cpu", "options": ["cpu"], "required": true, "help": {"short": "The amount of CPU to allocate to the workload."}}, {"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.resources.disk", "options": ["disk"], "help": {"short": "The amount of disk to allocate to the workload."}}, {"type": "string", "var": "$resource.properties.workload.AgentFabricSandbox.resources.memory", "options": ["memory"], "required": true, "help": {"short": "The amount of memory to allocate to the workload."}}]}]}]}]}, {"name": "Resource", "args": [{"type": "ResourceLocation", "var": "$resource.location", "options": ["l", "location"], "required": true, "group": "Resource", "help": {"short": "The geo-location where the resource lives"}}, {"type": "object", "var": "$resource.tags", "options": ["tags"], "group": "Resource", "help": {"short": "Resource tags."}, "additionalProps": {"item": {"type": "string"}}}]}], "operations": [{"longRunning": {"finalStateVia": "azure-async-operation"}, "operationId": "Members_CreateOrUpdate", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}", "request": {"method": "put", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "memberName", "arg": "$Path.memberName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"schema": {"type": "object", "name": "resource", "required": true, "props": [{"type": "ResourceLocation", "name": "location", "arg": "$resource.location", "required": true}, {"type": "object", "name": "properties", "props": [{"type": "object", "name": "workload", "arg": "$resource.properties.workload", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.workload.ACI", "value": "ACI"}, {"arg": "$resource.properties.workload.AgentFabricSandbox", "value": "AgentFabricSandbox"}]}}], "discriminators": [{"property": "type", "value": "ACI", "props": [{"type": "ResourceId", "name": "resourceId", "arg": "$resource.properties.workload.ACI.resourceId", "required": true}]}, {"property": "type", "value": "AgentFabricSandbox", "props": [{"type": "object", "name": "agentIdentity", "arg": "$resource.properties.workload.AgentFabricSandbox.agentIdentity", "props": [{"type": "string", "name": "agentId", "arg": "$resource.properties.workload.AgentFabricSandbox.agentIdentity.agentId", "required": true}, {"type": "string", "name": "tenantId", "arg": "$resource.properties.workload.AgentFabricSandbox.agentIdentity.tenantId", "required": true}]}, {"type": "string", "name": "domain", "arg": "$resource.properties.workload.AgentFabricSandbox.domain", "required": true}, {"type": "array<object>", "name": "endpoints", "arg": "$resource.properties.workload.AgentFabricSandbox.endpoints", "item": {"type": "object", "props": [{"type": "string", "name": "name", "arg": "$resource.properties.workload.AgentFabricSandbox.endpoints[].name", "required": true}, {"type": "integer32", "name": "port", "arg": "$resource.properties.workload.AgentFabricSandbox.endpoints[].port", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "image", "arg": "$resource.properties.workload.AgentFabricSandbox.image", "required": true, "props": [{"type": "string", "name": "digest", "arg": "$resource.properties.workload.AgentFabricSandbox.image.digest"}, {"type": "string", "name": "pullPolicy", "arg": "$resource.properties.workload.AgentFabricSandbox.image.pullPolicy", "enum": {"items": [{"value": "Always"}, {"value": "IfNotPresent"}]}}, {"type": "string", "name": "uri", "arg": "$resource.properties.workload.AgentFabricSandbox.image.uri", "required": true}]}, {"type": "object", "name": "resources", "arg": "$resource.properties.workload.AgentFabricSandbox.resources", "required": true, "props": [{"type": "string", "name": "cpu", "arg": "$resource.properties.workload.AgentFabricSandbox.resources.cpu", "required": true}, {"type": "string", "name": "disk", "arg": "$resource.properties.workload.AgentFabricSandbox.resources.disk"}, {"type": "string", "name": "memory", "arg": "$resource.properties.workload.AgentFabricSandbox.resources.memory", "required": true}]}]}]}]}, {"type": "object", "name": "tags", "arg": "$resource.tags", "additionalProps": {"item": {"type": "string"}}}], "clientFlatten": true}}}}, "responses": [{"statusCode": [200, 201], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"readOnly": true, "type": "string", "name": "spiffeId"}, {"type": "object", "name": "workload", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ACI"}, {"value": "AgentFabricSandbox"}]}}, {"readOnly": true, "type": "string", "name": "workloadId"}], "discriminators": [{"property": "type", "value": "ACI", "props": [{"type": "ResourceId", "name": "resourceId", "required": true}]}, {"property": "type", "value": "AgentFabricSandbox", "props": [{"type": "object", "name": "agentIdentity", "props": [{"type": "string", "name": "agentId", "required": true}, {"type": "string", "name": "tenantId", "required": true}]}, {"type": "string", "name": "domain", "required": true}, {"type": "array<object>", "name": "endpoints", "item": {"type": "object", "props": [{"type": "string", "name": "name", "required": true}, {"type": "integer32", "name": "port", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "image", "required": true, "props": [{"type": "string", "name": "digest"}, {"type": "string", "name": "pullPolicy", "enum": {"items": [{"value": "Always"}, {"value": "IfNotPresent"}]}}, {"type": "string", "name": "uri", "required": true}]}, {"type": "object", "name": "resources", "required": true, "props": [{"type": "string", "name": "cpu", "required": true}, {"type": "string", "name": "disk"}, {"type": "string", "name": "memory", "required": true}]}]}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "update", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the AgentFabric"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.memberName", "options": ["member-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the Member"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"type": "object", "var": "$properties.tags", "options": ["tags"], "group": "Properties", "help": {"short": "Resource tags."}, "additionalProps": {"item": {"type": "string"}}}]}], "operations": [{"longRunning": {"finalStateVia": "location"}, "operationId": "Members_Update", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}", "request": {"method": "patch", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "memberName", "arg": "$Path.memberName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"schema": {"type": "object", "name": "properties", "required": true, "props": [{"type": "object", "name": "tags", "arg": "$properties.tags", "additionalProps": {"item": {"type": "string"}}}], "clientFlatten": true}}}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"readOnly": true, "type": "string", "name": "spiffeId"}, {"type": "object", "name": "workload", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ACI"}, {"value": "AgentFabricSandbox"}]}}, {"readOnly": true, "type": "string", "name": "workloadId"}], "discriminators": [{"property": "type", "value": "ACI", "props": [{"type": "ResourceId", "name": "resourceId", "required": true}]}, {"property": "type", "value": "AgentFabricSandbox", "props": [{"type": "object", "name": "agentIdentity", "props": [{"type": "string", "name": "agentId", "required": true}, {"type": "string", "name": "tenantId", "required": true}]}, {"type": "string", "name": "domain", "required": true}, {"type": "array<object>", "name": "endpoints", "item": {"type": "object", "props": [{"type": "string", "name": "name", "required": true}, {"type": "integer32", "name": "port", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "image", "required": true, "props": [{"type": "string", "name": "digest"}, {"type": "string", "name": "pullPolicy", "enum": {"items": [{"value": "Always"}, {"value": "IfNotPresent"}]}}, {"type": "string", "name": "uri", "required": true}]}, {"type": "object", "name": "resources", "required": true, "props": [{"type": "string", "name": "cpu", "required": true}, {"type": "string", "name": "disk"}, {"type": "string", "name": "memory", "required": true}]}]}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"statusCode": [202], "header": {"items": [{"name": "Location"}, {"name": "Retry-After"}]}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.xml
new file mode 100644
index 000000000..5c33d26b4
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L21lbWJlcnMve30=/2026-07-21-preview.xml
@@ -0,0 +1,654 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <commandGroup name="agentfabric member">
+    <command name="show" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.memberName" options="member-name" required="True" idPart="child_name_1">
+          <help short="The name of the Member"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="Members_Get">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}">
+          <request method="get">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="memberName" arg="$Path.memberName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop readOnly="True" type="string" name="spiffeId"/>
+                    <prop type="object" name="workload">
+                      <prop type="string" name="type" required="True">
+                        <enum>
+                          <item value="&quot;ACI&quot;"/>
+                          <item value="&quot;AgentFabricSandbox&quot;"/>
+                        </enum>
+                      </prop>
+                      <prop readOnly="True" type="string" name="workloadId"/>
+                      <discriminator property="type" value="ACI">
+                        <prop type="ResourceId" name="resourceId" required="True"/>
+                      </discriminator>
+                      <discriminator property="type" value="AgentFabricSandbox">
+                        <prop type="object" name="agentIdentity">
+                          <prop type="string" name="agentId" required="True"/>
+                          <prop type="string" name="tenantId" required="True"/>
+                        </prop>
+                        <prop type="string" name="domain" required="True"/>
+                        <prop type="array<object>" name="endpoints" identifiers="name">
+                          <item type="object">
+                            <prop type="string" name="name" required="True"/>
+                            <prop type="integer32" name="port" required="True"/>
+                          </item>
+                        </prop>
+                        <prop type="object" name="image" required="True">
+                          <prop type="string" name="digest"/>
+                          <prop type="string" name="pullPolicy">
+                            <enum>
+                              <item value="&quot;Always&quot;"/>
+                              <item value="&quot;IfNotPresent&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="uri" required="True"/>
+                        </prop>
+                        <prop type="object" name="resources" required="True">
+                          <prop type="string" name="cpu" required="True"/>
+                          <prop type="string" name="disk"/>
+                          <prop type="string" name="memory" required="True"/>
+                        </prop>
+                      </discriminator>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="delete" version="2026-07-21-preview" confirmation="Are you sure you want to perform this operation?">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.memberName" options="member-name" required="True" idPart="child_name_1">
+          <help short="The name of the Member"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="Members_Delete">
+        <longRunning finalStateVia="location"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}">
+          <request method="delete">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="memberName" arg="$Path.memberName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="202">
+            <header>
+              <item name="Azure-AsyncOperation"/>
+              <item name="Location"/>
+              <item name="Retry-After"/>
+            </header>
+          </response>
+          <response statusCode="204"/>
+          <response statusCode="200 201"/>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+    </command>
+    <command name="create" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.memberName" options="member-name" required="True" idPart="child_name_1">
+          <help short="The name of the Member"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg type="object" var="$resource.properties.workload" options="workload" group="Properties">
+          <help short="The workload configuration of the member. Set at creation and immutable thereafter; to change the workload, delete and recreate the member."/>
+          <arg type="object" var="$resource.properties.workload.ACI" options="aci">
+            <arg type="ResourceId" var="$resource.properties.workload.ACI.resourceId" options="resource-id" required="True">
+              <help short="The Azure Resource Manager resource ID of the Azure Container Instances (ACI) container group backing this member's sandbox."/>
+            </arg>
+          </arg>
+          <arg type="object" var="$resource.properties.workload.AgentFabricSandbox" options="agent-fabric-sandbox">
+            <arg type="object" var="$resource.properties.workload.AgentFabricSandbox.agentIdentity" options="agent-identity">
+              <help short="The Entra agent identity associated with the workload."/>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.agentIdentity.agentId" options="agent-id" required="True">
+                <help short="The Entra agent ID representing the workload's identity."/>
+              </arg>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.agentIdentity.tenantId" options="tenant-id" required="True">
+                <help short="The Azure tenant ID that owns the agent identity."/>
+              </arg>
+            </arg>
+            <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.domain" options="domain" required="True">
+              <help short="The resolvable DNS name assigned to the workload."/>
+            </arg>
+            <arg type="array<object>" var="$resource.properties.workload.AgentFabricSandbox.endpoints" options="endpoints">
+              <help short="The network endpoints exposed by the workload."/>
+              <item type="object">
+                <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.endpoints[].name" options="name" required="True">
+                  <help short="The name of the endpoint."/>
+                </arg>
+                <arg type="integer32" var="$resource.properties.workload.AgentFabricSandbox.endpoints[].port" options="port" required="True">
+                  <help short="The port the endpoint listens on."/>
+                </arg>
+              </item>
+            </arg>
+            <arg type="object" var="$resource.properties.workload.AgentFabricSandbox.image" options="image" required="True">
+              <help short="The container image to run for the workload."/>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.image.digest" options="digest">
+                <help short="The image content digest used to pin an exact image version."/>
+              </arg>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.image.pullPolicy" options="pull-policy">
+                <help short="The policy controlling when the image is pulled."/>
+                <enum>
+                  <item name="Always" value="&quot;Always&quot;"/>
+                  <item name="IfNotPresent" value="&quot;IfNotPresent&quot;"/>
+                </enum>
+              </arg>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.image.uri" options="uri" required="True">
+                <help short="The image reference URI (e.g., registry/repository:tag)."/>
+              </arg>
+            </arg>
+            <arg type="object" var="$resource.properties.workload.AgentFabricSandbox.resources" options="resources" required="True">
+              <help short="The compute resources allocated to the workload."/>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.resources.cpu" options="cpu" required="True">
+                <help short="The amount of CPU to allocate to the workload."/>
+              </arg>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.resources.disk" options="disk">
+                <help short="The amount of disk to allocate to the workload."/>
+              </arg>
+              <arg type="string" var="$resource.properties.workload.AgentFabricSandbox.resources.memory" options="memory" required="True">
+                <help short="The amount of memory to allocate to the workload."/>
+              </arg>
+            </arg>
+          </arg>
+        </arg>
+      </argGroup>
+      <argGroup name="Resource">
+        <arg type="ResourceLocation" var="$resource.location" options="location l" required="True" group="Resource">
+          <help short="The geo-location where the resource lives"/>
+        </arg>
+        <arg type="object" var="$resource.tags" options="tags" group="Resource">
+          <help short="Resource tags."/>
+          <additionalProp>
+            <item type="string"/>
+          </additionalProp>
+        </arg>
+      </argGroup>
+      <operation operationId="Members_CreateOrUpdate">
+        <longRunning finalStateVia="azure-async-operation"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}">
+          <request method="put">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="memberName" arg="$Path.memberName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json>
+                <schema type="object" name="resource" required="True" clientFlatten="True">
+                  <prop type="ResourceLocation" name="location" arg="$resource.location" required="True"/>
+                  <prop type="object" name="properties">
+                    <prop type="object" name="workload" arg="$resource.properties.workload">
+                      <prop type="string" name="type" required="True">
+                        <enum>
+                          <item arg="$resource.properties.workload.ACI" value="&quot;ACI&quot;"/>
+                          <item arg="$resource.properties.workload.AgentFabricSandbox" value="&quot;AgentFabricSandbox&quot;"/>
+                        </enum>
+                      </prop>
+                      <discriminator property="type" value="ACI">
+                        <prop type="ResourceId" name="resourceId" arg="$resource.properties.workload.ACI.resourceId" required="True"/>
+                      </discriminator>
+                      <discriminator property="type" value="AgentFabricSandbox">
+                        <prop type="object" name="agentIdentity" arg="$resource.properties.workload.AgentFabricSandbox.agentIdentity">
+                          <prop type="string" name="agentId" arg="$resource.properties.workload.AgentFabricSandbox.agentIdentity.agentId" required="True"/>
+                          <prop type="string" name="tenantId" arg="$resource.properties.workload.AgentFabricSandbox.agentIdentity.tenantId" required="True"/>
+                        </prop>
+                        <prop type="string" name="domain" arg="$resource.properties.workload.AgentFabricSandbox.domain" required="True"/>
+                        <prop type="array<object>" name="endpoints" arg="$resource.properties.workload.AgentFabricSandbox.endpoints" identifiers="name">
+                          <item type="object">
+                            <prop type="string" name="name" arg="$resource.properties.workload.AgentFabricSandbox.endpoints[].name" required="True"/>
+                            <prop type="integer32" name="port" arg="$resource.properties.workload.AgentFabricSandbox.endpoints[].port" required="True"/>
+                          </item>
+                        </prop>
+                        <prop type="object" name="image" arg="$resource.properties.workload.AgentFabricSandbox.image" required="True">
+                          <prop type="string" name="digest" arg="$resource.properties.workload.AgentFabricSandbox.image.digest"/>
+                          <prop type="string" name="pullPolicy" arg="$resource.properties.workload.AgentFabricSandbox.image.pullPolicy">
+                            <enum>
+                              <item value="&quot;Always&quot;"/>
+                              <item value="&quot;IfNotPresent&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="uri" arg="$resource.properties.workload.AgentFabricSandbox.image.uri" required="True"/>
+                        </prop>
+                        <prop type="object" name="resources" arg="$resource.properties.workload.AgentFabricSandbox.resources" required="True">
+                          <prop type="string" name="cpu" arg="$resource.properties.workload.AgentFabricSandbox.resources.cpu" required="True"/>
+                          <prop type="string" name="disk" arg="$resource.properties.workload.AgentFabricSandbox.resources.disk"/>
+                          <prop type="string" name="memory" arg="$resource.properties.workload.AgentFabricSandbox.resources.memory" required="True"/>
+                        </prop>
+                      </discriminator>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags" arg="$resource.tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </request>
+          <response statusCode="200 201">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop readOnly="True" type="string" name="spiffeId"/>
+                    <prop type="object" name="workload">
+                      <prop type="string" name="type" required="True">
+                        <enum>
+                          <item value="&quot;ACI&quot;"/>
+                          <item value="&quot;AgentFabricSandbox&quot;"/>
+                        </enum>
+                      </prop>
+                      <prop readOnly="True" type="string" name="workloadId"/>
+                      <discriminator property="type" value="ACI">
+                        <prop type="ResourceId" name="resourceId" required="True"/>
+                      </discriminator>
+                      <discriminator property="type" value="AgentFabricSandbox">
+                        <prop type="object" name="agentIdentity">
+                          <prop type="string" name="agentId" required="True"/>
+                          <prop type="string" name="tenantId" required="True"/>
+                        </prop>
+                        <prop type="string" name="domain" required="True"/>
+                        <prop type="array<object>" name="endpoints" identifiers="name">
+                          <item type="object">
+                            <prop type="string" name="name" required="True"/>
+                            <prop type="integer32" name="port" required="True"/>
+                          </item>
+                        </prop>
+                        <prop type="object" name="image" required="True">
+                          <prop type="string" name="digest"/>
+                          <prop type="string" name="pullPolicy">
+                            <enum>
+                              <item value="&quot;Always&quot;"/>
+                              <item value="&quot;IfNotPresent&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="uri" required="True"/>
+                        </prop>
+                        <prop type="object" name="resources" required="True">
+                          <prop type="string" name="cpu" required="True"/>
+                          <prop type="string" name="disk"/>
+                          <prop type="string" name="memory" required="True"/>
+                        </prop>
+                      </discriminator>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="update" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/members/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9tZW1iZXJzL3ttZW1iZXJOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the AgentFabric"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.memberName" options="member-name" required="True" idPart="child_name_1">
+          <help short="The name of the Member"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg type="object" var="$properties.tags" options="tags" group="Properties">
+          <help short="Resource tags."/>
+          <additionalProp>
+            <item type="string"/>
+          </additionalProp>
+        </arg>
+      </argGroup>
+      <operation operationId="Members_Update">
+        <longRunning finalStateVia="location"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/members/{memberName}">
+          <request method="patch">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="memberName" arg="$Path.memberName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json>
+                <schema type="object" name="properties" required="True" clientFlatten="True">
+                  <prop type="object" name="tags" arg="$properties.tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/members/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop readOnly="True" type="string" name="spiffeId"/>
+                    <prop type="object" name="workload">
+                      <prop type="string" name="type" required="True">
+                        <enum>
+                          <item value="&quot;ACI&quot;"/>
+                          <item value="&quot;AgentFabricSandbox&quot;"/>
+                        </enum>
+                      </prop>
+                      <prop readOnly="True" type="string" name="workloadId"/>
+                      <discriminator property="type" value="ACI">
+                        <prop type="ResourceId" name="resourceId" required="True"/>
+                      </discriminator>
+                      <discriminator property="type" value="AgentFabricSandbox">
+                        <prop type="object" name="agentIdentity">
+                          <prop type="string" name="agentId" required="True"/>
+                          <prop type="string" name="tenantId" required="True"/>
+                        </prop>
+                        <prop type="string" name="domain" required="True"/>
+                        <prop type="array<object>" name="endpoints" identifiers="name">
+                          <item type="object">
+                            <prop type="string" name="name" required="True"/>
+                            <prop type="integer32" name="port" required="True"/>
+                          </item>
+                        </prop>
+                        <prop type="object" name="image" required="True">
+                          <prop type="string" name="digest"/>
+                          <prop type="string" name="pullPolicy">
+                            <enum>
+                              <item value="&quot;Always&quot;"/>
+                              <item value="&quot;IfNotPresent&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="uri" required="True"/>
+                        </prop>
+                        <prop type="object" name="resources" required="True">
+                          <prop type="string" name="cpu" required="True"/>
+                          <prop type="string" name="disk"/>
+                          <prop type="string" name="memory" required="True"/>
+                        </prop>
+                      </discriminator>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response statusCode="202">
+            <header>
+              <item name="Location"/>
+              <item name="Retry-After"/>
+            </header>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+  </commandGroup>
+</CodeGen>
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnM=/2026-09-10-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnM=/2026-09-10-preview.json
new file mode 100644
index 000000000..2fe56dbfe
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnM=/2026-09-10-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations", "version": "2026-09-10-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25z/V/MjAyNi0wOS0xMC1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric aks", "commands": [{"name": "list", "version": "2026-09-10-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations", "version": "2026-09-10-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25z/V/MjAyNi0wOS0xMC1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the parent Agent Fabric."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"operationId": "ClusterAssociations_ListByParent", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-09-10-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"type": "string", "name": "nextLink"}, {"type": "array<object>", "name": "value", "required": true, "item": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"}}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "ResourceId", "name": "clusterResourceId", "required": true}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "sku", "enum": {"items": [{"value": "Premium"}, {"value": "Standard"}]}}, {"readOnly": true, "type": "object", "name": "status", "props": [{"readOnly": true, "type": "string", "name": "code"}, {"readOnly": true, "type": "string", "name": "message"}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"readOnly": true, "type": "string", "name": "type"}]}}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "array", "ref": "$Instance.value", "clientFlatten": true, "nextLink": "$Instance.nextLink"}]}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnM=/2026-09-10-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnM=/2026-09-10-preview.xml
new file mode 100644
index 000000000..c19b1e2de
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnM=/2026-09-10-preview.xml
@@ -0,0 +1,114 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations" version="2026-09-10-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25z/V/MjAyNi0wOS0xMC1wcmV2aWV3"/>
+  <commandGroup name="agentfabric aks">
+    <command name="list" version="2026-09-10-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations" version="2026-09-10-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25z/V/MjAyNi0wOS0xMC1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the parent Agent Fabric."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="ClusterAssociations_ListByParent">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations">
+          <request method="get">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-09-10-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop type="string" name="nextLink"/>
+                  <prop type="array<object>" name="value" required="True">
+                    <item type="object">
+                      <prop readOnly="True" type="ResourceId" name="id">
+                        <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"/>
+                      </prop>
+                      <prop readOnly="True" type="string" name="name"/>
+                      <prop type="object" name="properties">
+                        <prop type="ResourceId" name="clusterResourceId" required="True"/>
+                        <prop readOnly="True" type="string" name="provisioningState">
+                          <enum>
+                            <item value="&quot;Accepted&quot;"/>
+                            <item value="&quot;Canceled&quot;"/>
+                            <item value="&quot;Deleting&quot;"/>
+                            <item value="&quot;Failed&quot;"/>
+                            <item value="&quot;Provisioning&quot;"/>
+                            <item value="&quot;Succeeded&quot;"/>
+                            <item value="&quot;Updating&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="string" name="sku">
+                          <enum>
+                            <item value="&quot;Premium&quot;"/>
+                            <item value="&quot;Standard&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop readOnly="True" type="object" name="status">
+                          <prop readOnly="True" type="string" name="code"/>
+                          <prop readOnly="True" type="string" name="message"/>
+                        </prop>
+                      </prop>
+                      <prop readOnly="True" type="object" name="systemData">
+                        <prop type="dateTime" name="createdAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="createdBy"/>
+                        <prop type="string" name="createdByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                        <prop type="dateTime" name="lastModifiedAt">
+                          <format protocol="iso"/>
+                        </prop>
+                        <prop type="string" name="lastModifiedBy"/>
+                        <prop type="string" name="lastModifiedByType">
+                          <enum>
+                            <item value="&quot;Application&quot;"/>
+                            <item value="&quot;Key&quot;"/>
+                            <item value="&quot;ManagedIdentity&quot;"/>
+                            <item value="&quot;User&quot;"/>
+                          </enum>
+                        </prop>
+                      </prop>
+                      <prop readOnly="True" type="string" name="type"/>
+                    </item>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="array" ref="$Instance.value" clientFlatten="True" nextLink="$Instance.nextLink"/>
+    </command>
+  </commandGroup>
+</CodeGen>
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.json
new file mode 100644
index 000000000..753d7288a
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}", "version": "2026-09-10-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric aks", "commands": [{"name": "show", "version": "2026-09-10-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}", "version": "2026-09-10-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the parent Agent Fabric."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.clusterAssociationName", "options": ["cluster-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"operationId": "ClusterAssociations_Get", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "clusterAssociationName", "arg": "$Path.clusterAssociationName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-09-10-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"}}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "ResourceId", "name": "clusterResourceId", "required": true}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "sku", "enum": {"items": [{"value": "Premium"}, {"value": "Standard"}]}}, {"readOnly": true, "type": "object", "name": "status", "props": [{"readOnly": true, "type": "string", "name": "code"}, {"readOnly": true, "type": "string", "name": "message"}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "update", "version": "2026-09-10-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}", "version": "2026-09-10-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the parent Agent Fabric."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.clusterAssociationName", "options": ["cluster-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"nullable": true, "type": "string", "var": "$resource.properties.sku", "options": ["sku"], "group": "Properties", "help": {"short": "Determines which AgentFabric components are deployed to the cluster. Defaults to Standard when omitted at creation and remains unchanged when omitted during an update."}, "enum": {"items": [{"name": "Premium", "value": "Premium"}, {"name": "Standard", "value": "Standard"}]}}]}], "operations": [{"operationId": "ClusterAssociations_Get", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "clusterAssociationName", "arg": "$Path.clusterAssociationName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-09-10-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"}}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "ResourceId", "name": "clusterResourceId", "required": true}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "sku", "enum": {"items": [{"value": "Premium"}, {"value": "Standard"}]}}, {"readOnly": true, "type": "object", "name": "status", "props": [{"readOnly": true, "type": "string", "name": "code"}, {"readOnly": true, "type": "string", "name": "message"}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"readOnly": true, "type": "string", "name": "type"}], "cls": "ClusterAssociation_read"}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}, {"instanceUpdate": {"ref": "$Instance", "json": {"schema": {"type": "object", "name": "resource", "required": true, "props": [{"type": "object", "name": "properties", "props": [{"type": "string", "name": "sku", "arg": "$resource.properties.sku", "enum": {"items": [{"value": "Premium"}, {"value": "Standard"}]}}]}], "clientFlatten": true}}}}, {"longRunning": {"finalStateVia": "azure-async-operation"}, "operationId": "ClusterAssociations_CreateOrUpdate", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}", "request": {"method": "put", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "clusterAssociationName", "arg": "$Path.clusterAssociationName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-09-10-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"ref": "$Instance"}}}, "responses": [{"statusCode": [200, 201], "body": {"json": {"var": "$Instance", "schema": {"type": "@ClusterAssociation_read"}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "attach", "version": "2026-09-10-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}", "version": "2026-09-10-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the parent Agent Fabric."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.clusterAssociationName", "options": ["cluster-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"type": "ResourceId", "var": "$resource.properties.clusterResourceId", "options": ["cluster-resource-id"], "required": true, "group": "Properties", "help": {"short": "The AKS managed cluster to enroll. The cluster must be in the same subscription as the AgentFabric; a different resource group is allowed. Set at creation and immutable thereafter; to enroll a different cluster, delete and recreate the association."}}, {"type": "string", "var": "$resource.properties.sku", "options": ["sku"], "group": "Properties", "help": {"short": "Determines which AgentFabric components are deployed to the cluster. Defaults to Standard when omitted at creation and remains unchanged when omitted during an update."}, "enum": {"items": [{"name": "Premium", "value": "Premium"}, {"name": "Standard", "value": "Standard"}]}}]}], "operations": [{"longRunning": {"finalStateVia": "azure-async-operation"}, "operationId": "ClusterAssociations_CreateOrUpdate", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}", "request": {"method": "put", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "clusterAssociationName", "arg": "$Path.clusterAssociationName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-09-10-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"schema": {"type": "object", "name": "resource", "required": true, "props": [{"type": "object", "name": "properties", "props": [{"type": "ResourceId", "name": "clusterResourceId", "arg": "$resource.properties.clusterResourceId", "required": true}, {"type": "string", "name": "sku", "arg": "$resource.properties.sku", "enum": {"items": [{"value": "Premium"}, {"value": "Standard"}]}}]}], "clientFlatten": true}}}}, "responses": [{"statusCode": [200, 201], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"}}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "ResourceId", "name": "clusterResourceId", "required": true}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}, {"type": "string", "name": "sku", "enum": {"items": [{"value": "Premium"}, {"value": "Standard"}]}}, {"readOnly": true, "type": "object", "name": "status", "props": [{"readOnly": true, "type": "string", "name": "code"}, {"readOnly": true, "type": "string", "name": "message"}]}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "detach", "version": "2026-09-10-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}", "version": "2026-09-10-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.agentFabricName", "options": ["fabric-name"], "required": true, "idPart": "name", "help": {"short": "The name of the parent Agent Fabric."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "var": "$Path.clusterAssociationName", "options": ["cluster-name"], "required": true, "idPart": "child_name_1", "help": {"short": "The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"longRunning": {"finalStateVia": "location"}, "operationId": "ClusterAssociations_Delete", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}", "request": {"method": "delete", "path": {"params": [{"type": "string", "name": "agentFabricName", "arg": "$Path.agentFabricName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "clusterAssociationName", "arg": "$Path.clusterAssociationName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-09-10-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [202], "header": {"items": [{"name": "Azure-AsyncOperation"}, {"name": "Location"}, {"name": "Retry-After"}]}}, {"statusCode": [204]}, {"statusCode": [200, 201]}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "confirmation": "Are you sure you want to perform this operation?"}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.xml
new file mode 100644
index 000000000..444f15c05
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvYWdlbnRmYWJyaWNzL3t9L2NsdXN0ZXJhc3NvY2lhdGlvbnMve30=/2026-09-10-preview.xml
@@ -0,0 +1,487 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}" version="2026-09-10-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"/>
+  <commandGroup name="agentfabric aks">
+    <command name="show" version="2026-09-10-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}" version="2026-09-10-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the parent Agent Fabric."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.clusterAssociationName" options="cluster-name" required="True" idPart="child_name_1">
+          <help short="The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="ClusterAssociations_Get">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}">
+          <request method="get">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="clusterAssociationName" arg="$Path.clusterAssociationName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-09-10-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"/>
+                  </prop>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="ResourceId" name="clusterResourceId" required="True"/>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="string" name="sku">
+                      <enum>
+                        <item value="&quot;Premium&quot;"/>
+                        <item value="&quot;Standard&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop readOnly="True" type="object" name="status">
+                      <prop readOnly="True" type="string" name="code"/>
+                      <prop readOnly="True" type="string" name="message"/>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="update" version="2026-09-10-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}" version="2026-09-10-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the parent Agent Fabric."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.clusterAssociationName" options="cluster-name" required="True" idPart="child_name_1">
+          <help short="The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg nullable="True" type="string" var="$resource.properties.sku" options="sku" group="Properties">
+          <help short="Determines which AgentFabric components are deployed to the cluster. Defaults to Standard when omitted at creation and remains unchanged when omitted during an update."/>
+          <enum>
+            <item name="Premium" value="&quot;Premium&quot;"/>
+            <item name="Standard" value="&quot;Standard&quot;"/>
+          </enum>
+        </arg>
+      </argGroup>
+      <operation operationId="ClusterAssociations_Get">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}">
+          <request method="get">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="clusterAssociationName" arg="$Path.clusterAssociationName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-09-10-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object" cls="ClusterAssociation_read">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"/>
+                  </prop>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="ResourceId" name="clusterResourceId" required="True"/>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="string" name="sku">
+                      <enum>
+                        <item value="&quot;Premium&quot;"/>
+                        <item value="&quot;Standard&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop readOnly="True" type="object" name="status">
+                      <prop readOnly="True" type="string" name="code"/>
+                      <prop readOnly="True" type="string" name="message"/>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <operation>
+        <instanceUpdate ref="$Instance">
+          <json>
+            <schema type="object" name="resource" required="True" clientFlatten="True">
+              <prop type="object" name="properties">
+                <prop type="string" name="sku" arg="$resource.properties.sku">
+                  <enum>
+                    <item value="&quot;Premium&quot;"/>
+                    <item value="&quot;Standard&quot;"/>
+                  </enum>
+                </prop>
+              </prop>
+            </schema>
+          </json>
+        </instanceUpdate>
+      </operation>
+      <operation operationId="ClusterAssociations_CreateOrUpdate">
+        <longRunning finalStateVia="azure-async-operation"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}">
+          <request method="put">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="clusterAssociationName" arg="$Path.clusterAssociationName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-09-10-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json ref="$Instance"/>
+            </body>
+          </request>
+          <response statusCode="200 201">
+            <body>
+              <json var="$Instance">
+                <schema type="@ClusterAssociation_read"/>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="attach" version="2026-09-10-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}" version="2026-09-10-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the parent Agent Fabric."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.clusterAssociationName" options="cluster-name" required="True" idPart="child_name_1">
+          <help short="The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg type="ResourceId" var="$resource.properties.clusterResourceId" options="cluster-resource-id" required="True" group="Properties">
+          <help short="The AKS managed cluster to enroll. The cluster must be in the same subscription as the AgentFabric; a different resource group is allowed. Set at creation and immutable thereafter; to enroll a different cluster, delete and recreate the association."/>
+        </arg>
+        <arg type="string" var="$resource.properties.sku" options="sku" group="Properties">
+          <help short="Determines which AgentFabric components are deployed to the cluster. Defaults to Standard when omitted at creation and remains unchanged when omitted during an update."/>
+          <enum>
+            <item name="Premium" value="&quot;Premium&quot;"/>
+            <item name="Standard" value="&quot;Standard&quot;"/>
+          </enum>
+        </arg>
+      </argGroup>
+      <operation operationId="ClusterAssociations_CreateOrUpdate">
+        <longRunning finalStateVia="azure-async-operation"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}">
+          <request method="put">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="clusterAssociationName" arg="$Path.clusterAssociationName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-09-10-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json>
+                <schema type="object" name="resource" required="True" clientFlatten="True">
+                  <prop type="object" name="properties">
+                    <prop type="ResourceId" name="clusterResourceId" arg="$resource.properties.clusterResourceId" required="True"/>
+                    <prop type="string" name="sku" arg="$resource.properties.sku">
+                      <enum>
+                        <item value="&quot;Premium&quot;"/>
+                        <item value="&quot;Standard&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </request>
+          <response statusCode="200 201">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/agentFabrics/{}/clusterAssociations/{}"/>
+                  </prop>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="ResourceId" name="clusterResourceId" required="True"/>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="string" name="sku">
+                      <enum>
+                        <item value="&quot;Premium&quot;"/>
+                        <item value="&quot;Standard&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop readOnly="True" type="object" name="status">
+                      <prop readOnly="True" type="string" name="code"/>
+                      <prop readOnly="True" type="string" name="message"/>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="detach" version="2026-09-10-preview" confirmation="Are you sure you want to perform this operation?">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/agentfabrics/{}/clusterassociations/{}" version="2026-09-10-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L2FnZW50RmFicmljcy97YWdlbnRGYWJyaWNOYW1lfS9jbHVzdGVyQXNzb2NpYXRpb25zL3tjbHVzdGVyQXNzb2NpYXRpb25OYW1lfQ==/V/MjAyNi0wOS0xMC1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.agentFabricName" options="fabric-name" required="True" idPart="name">
+          <help short="The name of the parent Agent Fabric."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="string" var="$Path.clusterAssociationName" options="cluster-name" required="True" idPart="child_name_1">
+          <help short="The name of the AKS cluster. This value is used as the Cluster Association ARM child resource name."/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="ClusterAssociations_Delete">
+        <longRunning finalStateVia="location"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/agentFabrics/{agentFabricName}/clusterAssociations/{clusterAssociationName}">
+          <request method="delete">
+            <path>
+              <param type="string" name="agentFabricName" arg="$Path.agentFabricName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="clusterAssociationName" arg="$Path.clusterAssociationName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-09-10-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="202">
+            <header>
+              <item name="Azure-AsyncOperation"/>
+              <item name="Location"/>
+              <item name="Retry-After"/>
+            </header>
+          </response>
+          <response statusCode="204"/>
+          <response statusCode="200 201"/>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+    </command>
+  </commandGroup>
+</CodeGen>
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.json b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.json
new file mode 100644
index 000000000..171437141
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.json
@@ -0,0 +1 @@
+{"plane": "mgmt-plane", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "commandGroups": [{"name": "agentfabric policy-group", "commands": [{"name": "show", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.policyGroupName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the PolicyGroup"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"operationId": "PolicyGroups_Get", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}", "request": {"method": "get", "path": {"params": [{"type": "string", "name": "policyGroupName", "arg": "$Path.policyGroupName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "string", "name": "description"}, {"type": "string", "name": "displayName"}, {"type": "array<object>", "name": "networkSecurityPolicies", "item": {"type": "object", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ContentInspection"}, {"value": "FqdnFiltering"}, {"value": "Mcp"}, {"value": "TlsInspection"}, {"value": "UrlFiltering"}]}}], "discriminators": [{"property": "type", "value": "ContentInspection", "props": [{"type": "object", "name": "promptInjectionProtection", "props": [{"type": "string", "name": "onDetection", "required": true, "enum": {"items": [{"value": "Alert"}, {"value": "BlockAndAlert"}, {"value": "Sanitize"}]}}, {"type": "array<string>", "name": "promptLocations", "item": {"type": "string"}}, {"type": "array<string>", "name": "responseLocations", "item": {"type": "string"}}, {"type": "string", "name": "sensitivity", "enum": {"items": [{"value": "High"}, {"value": "Low"}, {"value": "Medium"}]}}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "FqdnFiltering", "props": [{"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "Fqdns"}]}}], "discriminators": [{"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}]}, {"type": "string", "name": "direction", "enum": {"items": [{"value": "Both"}, {"value": "Inbound"}, {"value": "Outbound"}]}}, {"type": "string", "name": "name"}, {"type": "array<integer32>", "name": "ports", "item": {"type": "integer32"}}, {"type": "integer32", "name": "priority"}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "Mcp", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "array<string>", "name": "tools", "required": true, "item": {"type": "string"}}]}}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "TlsInspection", "props": [{"type": "object", "name": "certificate", "required": true, "props": [{"type": "string", "name": "mode", "required": true, "enum": {"items": [{"value": "AzureManagedCA"}]}}], "discriminators": [{"property": "mode", "value": "AzureManagedCA"}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "UrlFiltering", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "string", "name": "hostname"}, {"type": "string", "name": "method", "enum": {"items": [{"value": "DELETE"}, {"value": "GET"}, {"value": "HEAD"}, {"value": "OPTIONS"}, {"value": "PATCH"}, {"value": "POST"}, {"value": "PUT"}]}}, {"type": "string", "name": "name", "required": true}, {"type": "array<string>", "name": "paths", "item": {"type": "string"}}, {"type": "integer32", "name": "priority", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}]}}, {"type": "integer32", "name": "priority"}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "delete", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.policyGroupName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the PolicyGroup"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}], "operations": [{"longRunning": {"finalStateVia": "location"}, "operationId": "PolicyGroups_Delete", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}", "request": {"method": "delete", "path": {"params": [{"type": "string", "name": "policyGroupName", "arg": "$Path.policyGroupName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}}, "responses": [{"statusCode": [202], "header": {"items": [{"name": "Azure-AsyncOperation"}, {"name": "Location"}, {"name": "Retry-After"}]}}, {"statusCode": [204]}, {"statusCode": [200, 201]}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "confirmation": "Are you sure you want to perform this operation?"}, {"name": "create", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.policyGroupName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the PolicyGroup"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"type": "string", "var": "$resource.properties.description", "options": ["description"], "group": "Properties", "help": {"short": "The description of the policy group."}}, {"type": "string", "var": "$resource.properties.displayName", "options": ["display-name"], "group": "Properties", "help": {"short": "The display name of the policy group."}}, {"type": "array<object>", "var": "$resource.properties.networkSecurityPolicies", "options": ["network-security-policies"], "group": "Properties", "help": {"short": "The list of network security policies."}, "item": {"type": "object", "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection", "options": ["content-inspection"], "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection", "options": ["prompt-injection-protection"], "help": {"short": "The prompt injection protection configuration."}, "args": [{"type": "string", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.onDetection", "options": ["on-detection"], "required": true, "help": {"short": "The action to take when prompt injection is detected."}, "enum": {"items": [{"name": "Alert", "value": "Alert"}, {"name": "BlockAndAlert", "value": "BlockAndAlert"}, {"name": "Sanitize", "value": "Sanitize"}]}}, {"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.promptLocations", "options": ["prompt-locations"], "help": {"short": "The JSONPath expressions selecting the parts of the request body to scan for prompt injection."}, "item": {"type": "string"}}, {"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.responseLocations", "options": ["response-locations"], "help": {"short": "The JSONPath expressions selecting the parts of the response body to scan for prompt injection."}, "item": {"type": "string"}}, {"type": "string", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.sensitivity", "options": ["sensitivity"], "help": {"short": "The sensitivity level of prompt injection detection."}, "enum": {"items": [{"name": "High", "value": "High"}, {"name": "Low", "value": "Low"}, {"name": "Medium", "value": "Medium"}]}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.source", "options": ["source"], "required": true, "help": {"short": "The source details for the policy."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes", "options": ["address-prefixes"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes.prefixes", "options": ["prefixes"], "required": true, "help": {"short": "The IP address prefixes, in CIDR notation, that identify the source(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns", "options": ["workload-id-patterns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns.patterns", "options": ["patterns"], "required": true, "help": {"short": "The workload ID patterns that identify the source(s)."}, "item": {"type": "string"}}]}]}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering", "options": ["fqdn-filtering"], "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination", "options": ["destination"], "help": {"short": "The destination details for the policy."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns", "options": ["fqdns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns.fqdns", "options": ["fqdns"], "required": true, "help": {"short": "The fully qualified domain names that identify the destination(s)."}, "item": {"type": "string"}}]}]}, {"type": "string", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.direction", "options": ["direction"], "help": {"short": "The direction of traffic for the policy."}, "enum": {"items": [{"name": "Both", "value": "Both"}, {"name": "Inbound", "value": "Inbound"}, {"name": "Outbound", "value": "Outbound"}]}}, {"type": "string", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.name", "options": ["name"], "help": {"short": "The name of the policy."}}, {"type": "array<integer32>", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.ports", "options": ["ports"], "help": {"short": "The ports for the policy."}, "item": {"type": "integer32"}}, {"type": "integer32", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.priority", "options": ["priority"], "help": {"short": "The priority of the policy."}}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source", "options": ["source"], "required": true, "help": {"short": "The source details for the policy."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes", "options": ["address-prefixes"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes.prefixes", "options": ["prefixes"], "required": true, "help": {"short": "The IP address prefixes, in CIDR notation, that identify the source(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns", "options": ["workload-id-patterns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns.patterns", "options": ["patterns"], "required": true, "help": {"short": "The workload ID patterns that identify the source(s)."}, "item": {"type": "string"}}]}]}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp", "options": ["mcp"], "args": [{"type": "string", "var": "$resource.properties.networkSecurityPolicies[].Mcp.defaultAction", "options": ["default-action"], "required": true, "help": {"short": "The default action to take when no rule in the policy matches."}, "enum": {"items": [{"name": "Allow", "value": "Allow"}, {"name": "Deny", "value": "Deny"}]}}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp.destination", "options": ["destination"], "required": true, "help": {"short": "The MCP server(s) that this policy applies to."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes", "options": ["address-prefixes"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes.prefixes", "options": ["prefixes"], "required": true, "help": {"short": "The IP address prefixes, in CIDR notation, that identify the destination(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns", "options": ["fqdns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns.fqdns", "options": ["fqdns"], "required": true, "help": {"short": "The fully qualified domain names that identify the destination(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns", "options": ["workload-id-patterns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns.patterns", "options": ["patterns"], "required": true, "help": {"short": "The workload ID patterns that identify the destination(s)."}, "item": {"type": "string"}}]}]}, {"type": "array<object>", "var": "$resource.properties.networkSecurityPolicies[].Mcp.rules", "options": ["rules"], "required": true, "help": {"short": "The list of MCP rules."}, "item": {"type": "object", "args": [{"type": "string", "var": "$resource.properties.networkSecurityPolicies[].Mcp.rules[].action", "options": ["action"], "required": true, "help": {"short": "The action to take for the specified MCP tools."}, "enum": {"items": [{"name": "Allow", "value": "Allow"}, {"name": "Deny", "value": "Deny"}]}}, {"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].Mcp.rules[].tools", "options": ["tools"], "required": true, "help": {"short": "The MCP tool names that the rule applies to."}, "item": {"type": "string"}}]}}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp.source", "options": ["source"], "required": true, "help": {"short": "The source(s) that this policy applies to."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes", "options": ["address-prefixes"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes.prefixes", "options": ["prefixes"], "required": true, "help": {"short": "The IP address prefixes, in CIDR notation, that identify the source(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns", "options": ["workload-id-patterns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns.patterns", "options": ["patterns"], "required": true, "help": {"short": "The workload ID patterns that identify the source(s)."}, "item": {"type": "string"}}]}]}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].TlsInspection", "options": ["tls-inspection"], "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].TlsInspection.certificate", "options": ["certificate"], "required": true, "help": {"short": "The certificate configuration used for TLS inspection."}, "args": [{"blank": {"value": {}}, "type": "object", "var": "$resource.properties.networkSecurityPolicies[].TlsInspection.certificate.AzureManagedCA", "options": ["azure-managed-ca"]}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].TlsInspection.source", "options": ["source"], "required": true, "help": {"short": "The source details for the policy."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns", "options": ["workload-id-patterns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns.patterns", "options": ["patterns"], "required": true, "help": {"short": "The workload ID patterns that identify the source(s)."}, "item": {"type": "string"}}]}]}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering", "options": ["url-filtering"], "args": [{"type": "string", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.defaultAction", "options": ["default-action"], "required": true, "help": {"short": "The default action to take when no rule in the policy matches."}, "enum": {"items": [{"name": "Allow", "value": "Allow"}, {"name": "Deny", "value": "Deny"}]}}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination", "options": ["destination"], "help": {"short": "The destination details for the policy."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes", "options": ["address-prefixes"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes.prefixes", "options": ["prefixes"], "required": true, "help": {"short": "The IP address prefixes, in CIDR notation, that identify the destination(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns", "options": ["fqdns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns.fqdns", "options": ["fqdns"], "required": true, "help": {"short": "The fully qualified domain names that identify the destination(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns", "options": ["workload-id-patterns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns.patterns", "options": ["patterns"], "required": true, "help": {"short": "The workload ID patterns that identify the destination(s)."}, "item": {"type": "string"}}]}]}, {"type": "array<object>", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules", "options": ["rules"], "required": true, "help": {"short": "The list of URL filtering rules."}, "item": {"type": "object", "args": [{"type": "string", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].action", "options": ["action"], "required": true, "help": {"short": "The action to take when the rule matches."}, "enum": {"items": [{"name": "Allow", "value": "Allow"}, {"name": "Deny", "value": "Deny"}]}}, {"type": "string", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].hostname", "options": ["hostname"], "help": {"short": "The hostname matched by the rule. If omitted, the rule matches any hostname."}}, {"type": "string", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].method", "options": ["method"], "help": {"short": "The HTTP method matched by the rule. If omitted, the rule matches any method."}, "enum": {"items": [{"name": "DELETE", "value": "DELETE"}, {"name": "GET", "value": "GET"}, {"name": "HEAD", "value": "HEAD"}, {"name": "OPTIONS", "value": "OPTIONS"}, {"name": "PATCH", "value": "PATCH"}, {"name": "POST", "value": "POST"}, {"name": "PUT", "value": "PUT"}]}}, {"type": "string", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].name", "options": ["name"], "required": true, "help": {"short": "The name of the rule."}}, {"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].paths", "options": ["paths"], "help": {"short": "The URL paths matched by the rule. If omitted, the rule matches any path."}, "item": {"type": "string"}}, {"type": "integer32", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].priority", "options": ["priority"], "required": true, "help": {"short": "The priority of the rule. Rules are evaluated in ascending priority order."}}]}}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source", "options": ["source"], "required": true, "help": {"short": "The source details for the policy."}, "args": [{"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes", "options": ["address-prefixes"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes.prefixes", "options": ["prefixes"], "required": true, "help": {"short": "The IP address prefixes, in CIDR notation, that identify the source(s)."}, "item": {"type": "string"}}]}, {"type": "object", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns", "options": ["workload-id-patterns"], "args": [{"type": "array<string>", "var": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns.patterns", "options": ["patterns"], "required": true, "help": {"short": "The workload ID patterns that identify the source(s)."}, "item": {"type": "string"}}]}]}]}]}}, {"type": "integer32", "var": "$resource.properties.priority", "options": ["priority"], "group": "Properties", "help": {"short": "The priority of the policy group."}}]}, {"name": "Resource", "args": [{"type": "ResourceLocation", "var": "$resource.location", "options": ["l", "location"], "required": true, "group": "Resource", "help": {"short": "The geo-location where the resource lives"}}, {"type": "object", "var": "$resource.tags", "options": ["tags"], "group": "Resource", "help": {"short": "Resource tags."}, "additionalProps": {"item": {"type": "string"}}}]}], "operations": [{"longRunning": {"finalStateVia": "azure-async-operation"}, "operationId": "PolicyGroups_CreateOrUpdate", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}", "request": {"method": "put", "path": {"params": [{"type": "string", "name": "policyGroupName", "arg": "$Path.policyGroupName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"schema": {"type": "object", "name": "resource", "required": true, "props": [{"type": "ResourceLocation", "name": "location", "arg": "$resource.location", "required": true}, {"type": "object", "name": "properties", "props": [{"type": "string", "name": "description", "arg": "$resource.properties.description"}, {"type": "string", "name": "displayName", "arg": "$resource.properties.displayName"}, {"type": "array<object>", "name": "networkSecurityPolicies", "arg": "$resource.properties.networkSecurityPolicies", "item": {"type": "object", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].ContentInspection", "value": "ContentInspection"}, {"arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering", "value": "FqdnFiltering"}, {"arg": "$resource.properties.networkSecurityPolicies[].Mcp", "value": "Mcp"}, {"arg": "$resource.properties.networkSecurityPolicies[].TlsInspection", "value": "TlsInspection"}, {"arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering", "value": "UrlFiltering"}]}}], "discriminators": [{"property": "type", "value": "ContentInspection", "props": [{"type": "object", "name": "promptInjectionProtection", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection", "props": [{"type": "string", "name": "onDetection", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.onDetection", "required": true, "enum": {"items": [{"value": "Alert"}, {"value": "BlockAndAlert"}, {"value": "Sanitize"}]}}, {"type": "array<string>", "name": "promptLocations", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.promptLocations", "item": {"type": "string"}}, {"type": "array<string>", "name": "responseLocations", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.responseLocations", "item": {"type": "string"}}, {"type": "string", "name": "sensitivity", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.sensitivity", "enum": {"items": [{"value": "High"}, {"value": "Low"}, {"value": "Medium"}]}}]}, {"type": "object", "name": "source", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes", "value": "AddressPrefixes"}, {"arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns", "value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes.prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "arg": "$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns.patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "FqdnFiltering", "props": [{"type": "object", "name": "destination", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns", "value": "Fqdns"}]}}], "discriminators": [{"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns.fqdns", "required": true, "item": {"type": "string"}}]}]}, {"type": "string", "name": "direction", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.direction", "enum": {"items": [{"value": "Both"}, {"value": "Inbound"}, {"value": "Outbound"}]}}, {"type": "string", "name": "name", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.name"}, {"type": "array<integer32>", "name": "ports", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.ports", "item": {"type": "integer32"}}, {"type": "integer32", "name": "priority", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.priority"}, {"type": "object", "name": "source", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes", "value": "AddressPrefixes"}, {"arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns", "value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes.prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "arg": "$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns.patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "Mcp", "props": [{"type": "string", "name": "defaultAction", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.destination", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes", "value": "AddressPrefixes"}, {"arg": "$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns", "value": "Fqdns"}, {"arg": "$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns", "value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes.prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns.fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns.patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.rules[].action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "array<string>", "name": "tools", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.rules[].tools", "required": true, "item": {"type": "string"}}]}}, {"type": "object", "name": "source", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes", "value": "AddressPrefixes"}, {"arg": "$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns", "value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes.prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "arg": "$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns.patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "TlsInspection", "props": [{"type": "object", "name": "certificate", "arg": "$resource.properties.networkSecurityPolicies[].TlsInspection.certificate", "required": true, "props": [{"type": "string", "name": "mode", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].TlsInspection.certificate.AzureManagedCA", "value": "AzureManagedCA"}]}}], "discriminators": [{"property": "mode", "value": "AzureManagedCA"}]}, {"type": "object", "name": "source", "arg": "$resource.properties.networkSecurityPolicies[].TlsInspection.source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns", "value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "arg": "$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns.patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "UrlFiltering", "props": [{"type": "string", "name": "defaultAction", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes", "value": "AddressPrefixes"}, {"arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns", "value": "Fqdns"}, {"arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns", "value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes.prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns.fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns.patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "string", "name": "hostname", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].hostname"}, {"type": "string", "name": "method", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].method", "enum": {"items": [{"value": "DELETE"}, {"value": "GET"}, {"value": "HEAD"}, {"value": "OPTIONS"}, {"value": "PATCH"}, {"value": "POST"}, {"value": "PUT"}]}}, {"type": "string", "name": "name", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].name", "required": true}, {"type": "array<string>", "name": "paths", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].paths", "item": {"type": "string"}}, {"type": "integer32", "name": "priority", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].priority", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "source", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes", "value": "AddressPrefixes"}, {"arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns", "value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes.prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "arg": "$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns.patterns", "required": true, "item": {"type": "string"}}]}]}]}]}}, {"type": "integer32", "name": "priority", "arg": "$resource.properties.priority"}]}, {"type": "object", "name": "tags", "arg": "$resource.tags", "additionalProps": {"item": {"type": "string"}}}], "clientFlatten": true}}}}, "responses": [{"statusCode": [200, 201], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "string", "name": "description"}, {"type": "string", "name": "displayName"}, {"type": "array<object>", "name": "networkSecurityPolicies", "item": {"type": "object", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ContentInspection"}, {"value": "FqdnFiltering"}, {"value": "Mcp"}, {"value": "TlsInspection"}, {"value": "UrlFiltering"}]}}], "discriminators": [{"property": "type", "value": "ContentInspection", "props": [{"type": "object", "name": "promptInjectionProtection", "props": [{"type": "string", "name": "onDetection", "required": true, "enum": {"items": [{"value": "Alert"}, {"value": "BlockAndAlert"}, {"value": "Sanitize"}]}}, {"type": "array<string>", "name": "promptLocations", "item": {"type": "string"}}, {"type": "array<string>", "name": "responseLocations", "item": {"type": "string"}}, {"type": "string", "name": "sensitivity", "enum": {"items": [{"value": "High"}, {"value": "Low"}, {"value": "Medium"}]}}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "FqdnFiltering", "props": [{"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "Fqdns"}]}}], "discriminators": [{"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}]}, {"type": "string", "name": "direction", "enum": {"items": [{"value": "Both"}, {"value": "Inbound"}, {"value": "Outbound"}]}}, {"type": "string", "name": "name"}, {"type": "array<integer32>", "name": "ports", "item": {"type": "integer32"}}, {"type": "integer32", "name": "priority"}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "Mcp", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "array<string>", "name": "tools", "required": true, "item": {"type": "string"}}]}}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "TlsInspection", "props": [{"type": "object", "name": "certificate", "required": true, "props": [{"type": "string", "name": "mode", "required": true, "enum": {"items": [{"value": "AzureManagedCA"}]}}], "discriminators": [{"property": "mode", "value": "AzureManagedCA"}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "UrlFiltering", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "string", "name": "hostname"}, {"type": "string", "name": "method", "enum": {"items": [{"value": "DELETE"}, {"value": "GET"}, {"value": "HEAD"}, {"value": "OPTIONS"}, {"value": "PATCH"}, {"value": "POST"}, {"value": "PUT"}]}}, {"type": "string", "name": "name", "required": true}, {"type": "array<string>", "name": "paths", "item": {"type": "string"}}, {"type": "integer32", "name": "priority", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}]}}, {"type": "integer32", "name": "priority"}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}, {"name": "update", "version": "2026-07-21-preview", "resources": [{"id": "/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}", "version": "2026-07-21-preview", "swagger": "mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"}], "argGroups": [{"name": "", "args": [{"type": "string", "var": "$Path.policyGroupName", "options": ["n", "name"], "required": true, "idPart": "name", "help": {"short": "The name of the PolicyGroup"}, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "ResourceGroupName", "var": "$Path.resourceGroupName", "options": ["g", "resource-group"], "required": true, "idPart": "resource_group"}, {"type": "SubscriptionId", "var": "$Path.subscriptionId", "options": ["subscription"], "required": true, "idPart": "subscription"}]}, {"name": "Properties", "args": [{"type": "object", "var": "$properties.tags", "options": ["tags"], "group": "Properties", "help": {"short": "Resource tags."}, "additionalProps": {"item": {"type": "string"}}}]}], "operations": [{"longRunning": {"finalStateVia": "location"}, "operationId": "PolicyGroups_Update", "http": {"path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}", "request": {"method": "patch", "path": {"params": [{"type": "string", "name": "policyGroupName", "arg": "$Path.policyGroupName", "required": true, "format": {"pattern": "^[a-zA-Z0-9-]{3,24}$"}}, {"type": "string", "name": "resourceGroupName", "arg": "$Path.resourceGroupName", "required": true, "format": {"maxLength": 90, "minLength": 1}}, {"type": "uuid", "name": "subscriptionId", "arg": "$Path.subscriptionId", "required": true}]}, "query": {"consts": [{"readOnly": true, "const": true, "default": {"value": "2026-07-21-preview"}, "type": "string", "name": "api-version", "required": true, "format": {"minLength": 1}}]}, "body": {"json": {"schema": {"type": "object", "name": "properties", "required": true, "props": [{"type": "object", "name": "tags", "arg": "$properties.tags", "additionalProps": {"item": {"type": "string"}}}], "clientFlatten": true}}}}, "responses": [{"statusCode": [200], "body": {"json": {"var": "$Instance", "schema": {"type": "object", "props": [{"readOnly": true, "type": "ResourceId", "name": "id", "format": {"template": "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"}}, {"type": "ResourceLocation", "name": "location", "required": true}, {"readOnly": true, "type": "string", "name": "name"}, {"type": "object", "name": "properties", "props": [{"type": "string", "name": "description"}, {"type": "string", "name": "displayName"}, {"type": "array<object>", "name": "networkSecurityPolicies", "item": {"type": "object", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "ContentInspection"}, {"value": "FqdnFiltering"}, {"value": "Mcp"}, {"value": "TlsInspection"}, {"value": "UrlFiltering"}]}}], "discriminators": [{"property": "type", "value": "ContentInspection", "props": [{"type": "object", "name": "promptInjectionProtection", "props": [{"type": "string", "name": "onDetection", "required": true, "enum": {"items": [{"value": "Alert"}, {"value": "BlockAndAlert"}, {"value": "Sanitize"}]}}, {"type": "array<string>", "name": "promptLocations", "item": {"type": "string"}}, {"type": "array<string>", "name": "responseLocations", "item": {"type": "string"}}, {"type": "string", "name": "sensitivity", "enum": {"items": [{"value": "High"}, {"value": "Low"}, {"value": "Medium"}]}}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "FqdnFiltering", "props": [{"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "Fqdns"}]}}], "discriminators": [{"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}]}, {"type": "string", "name": "direction", "enum": {"items": [{"value": "Both"}, {"value": "Inbound"}, {"value": "Outbound"}]}}, {"type": "string", "name": "name"}, {"type": "array<integer32>", "name": "ports", "item": {"type": "integer32"}}, {"type": "integer32", "name": "priority"}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "Mcp", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "array<string>", "name": "tools", "required": true, "item": {"type": "string"}}]}}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "TlsInspection", "props": [{"type": "object", "name": "certificate", "required": true, "props": [{"type": "string", "name": "mode", "required": true, "enum": {"items": [{"value": "AzureManagedCA"}]}}], "discriminators": [{"property": "mode", "value": "AzureManagedCA"}]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}, {"property": "type", "value": "UrlFiltering", "props": [{"type": "string", "name": "defaultAction", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "object", "name": "destination", "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "Fqdns"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "Fqdns", "props": [{"type": "array<string>", "name": "fqdns", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}, {"type": "array<object>", "name": "rules", "required": true, "item": {"type": "object", "props": [{"type": "string", "name": "action", "required": true, "enum": {"items": [{"value": "Allow"}, {"value": "Deny"}]}}, {"type": "string", "name": "hostname"}, {"type": "string", "name": "method", "enum": {"items": [{"value": "DELETE"}, {"value": "GET"}, {"value": "HEAD"}, {"value": "OPTIONS"}, {"value": "PATCH"}, {"value": "POST"}, {"value": "PUT"}]}}, {"type": "string", "name": "name", "required": true}, {"type": "array<string>", "name": "paths", "item": {"type": "string"}}, {"type": "integer32", "name": "priority", "required": true}]}, "identifiers": ["name"]}, {"type": "object", "name": "source", "required": true, "props": [{"type": "string", "name": "type", "required": true, "enum": {"items": [{"value": "AddressPrefixes"}, {"value": "WorkloadIdPatterns"}]}}], "discriminators": [{"property": "type", "value": "AddressPrefixes", "props": [{"type": "array<string>", "name": "prefixes", "required": true, "item": {"type": "string"}}]}, {"property": "type", "value": "WorkloadIdPatterns", "props": [{"type": "array<string>", "name": "patterns", "required": true, "item": {"type": "string"}}]}]}]}]}}, {"type": "integer32", "name": "priority"}, {"readOnly": true, "type": "string", "name": "provisioningState", "enum": {"items": [{"value": "Accepted"}, {"value": "Canceled"}, {"value": "Deleting"}, {"value": "Failed"}, {"value": "Provisioning"}, {"value": "Succeeded"}, {"value": "Updating"}]}}]}, {"readOnly": true, "type": "object", "name": "systemData", "props": [{"type": "dateTime", "name": "createdAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "createdBy"}, {"type": "string", "name": "createdByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}, {"type": "dateTime", "name": "lastModifiedAt", "format": {"protocol": "iso"}}, {"type": "string", "name": "lastModifiedBy"}, {"type": "string", "name": "lastModifiedByType", "enum": {"items": [{"value": "Application"}, {"value": "Key"}, {"value": "ManagedIdentity"}, {"value": "User"}]}}]}, {"type": "object", "name": "tags", "additionalProps": {"item": {"type": "string"}}}, {"readOnly": true, "type": "string", "name": "type"}]}}}}, {"statusCode": [202], "header": {"items": [{"name": "Location"}, {"name": "Retry-After"}]}}, {"isError": true, "body": {"json": {"schema": {"type": "@MgmtErrorFormat"}}}}]}}], "outputs": [{"type": "object", "ref": "$Instance", "clientFlatten": true}]}]}]}
\ No newline at end of file
diff --git a/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.xml b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.xml
new file mode 100644
index 000000000..d656bd4d6
--- /dev/null
+++ b/Resources/mgmt-plane/L3N1YnNjcmlwdGlvbnMve30vcmVzb3VyY2Vncm91cHMve30vcHJvdmlkZXJzL21pY3Jvc29mdC5uZXR3b3Jrc2VjdXJpdHkvcG9saWN5Z3JvdXBzL3t9/2026-07-21-preview.xml
@@ -0,0 +1,1721 @@
+<?xml version='1.0' encoding='utf-8'?>
+<CodeGen plane="mgmt-plane">
+  <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+  <commandGroup name="agentfabric policy-group">
+    <command name="show" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.policyGroupName" options="name n" required="True" idPart="name">
+          <help short="The name of the PolicyGroup"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="PolicyGroups_Get">
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}">
+          <request method="get">
+            <path>
+              <param type="string" name="policyGroupName" arg="$Path.policyGroupName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="string" name="description"/>
+                    <prop type="string" name="displayName"/>
+                    <prop type="array<object>" name="networkSecurityPolicies">
+                      <item type="object">
+                        <prop type="string" name="type" required="True">
+                          <enum>
+                            <item value="&quot;ContentInspection&quot;"/>
+                            <item value="&quot;FqdnFiltering&quot;"/>
+                            <item value="&quot;Mcp&quot;"/>
+                            <item value="&quot;TlsInspection&quot;"/>
+                            <item value="&quot;UrlFiltering&quot;"/>
+                          </enum>
+                        </prop>
+                        <discriminator property="type" value="ContentInspection">
+                          <prop type="object" name="promptInjectionProtection">
+                            <prop type="string" name="onDetection" required="True">
+                              <enum>
+                                <item value="&quot;Alert&quot;"/>
+                                <item value="&quot;BlockAndAlert&quot;"/>
+                                <item value="&quot;Sanitize&quot;"/>
+                              </enum>
+                            </prop>
+                            <prop type="array<string>" name="promptLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="array<string>" name="responseLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="string" name="sensitivity">
+                              <enum>
+                                <item value="&quot;High&quot;"/>
+                                <item value="&quot;Low&quot;"/>
+                                <item value="&quot;Medium&quot;"/>
+                              </enum>
+                            </prop>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="FqdnFiltering">
+                          <prop type="object" name="destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;Fqdns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="string" name="direction">
+                            <enum>
+                              <item value="&quot;Both&quot;"/>
+                              <item value="&quot;Inbound&quot;"/>
+                              <item value="&quot;Outbound&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="name"/>
+                          <prop type="array<integer32>" name="ports">
+                            <item type="integer32"/>
+                          </prop>
+                          <prop type="integer32" name="priority"/>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="Mcp">
+                          <prop type="string" name="defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;Fqdns&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" required="True">
+                            <item type="object">
+                              <prop type="string" name="action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="array<string>" name="tools" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="TlsInspection">
+                          <prop type="object" name="certificate" required="True">
+                            <prop type="string" name="mode" required="True">
+                              <enum>
+                                <item value="&quot;AzureManagedCA&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="mode" value="AzureManagedCA"/>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="UrlFiltering">
+                          <prop type="string" name="defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;Fqdns&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" required="True" identifiers="name">
+                            <item type="object">
+                              <prop type="string" name="action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="hostname"/>
+                              <prop type="string" name="method">
+                                <enum>
+                                  <item value="&quot;DELETE&quot;"/>
+                                  <item value="&quot;GET&quot;"/>
+                                  <item value="&quot;HEAD&quot;"/>
+                                  <item value="&quot;OPTIONS&quot;"/>
+                                  <item value="&quot;PATCH&quot;"/>
+                                  <item value="&quot;POST&quot;"/>
+                                  <item value="&quot;PUT&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="name" required="True"/>
+                              <prop type="array<string>" name="paths">
+                                <item type="string"/>
+                              </prop>
+                              <prop type="integer32" name="priority" required="True"/>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                      </item>
+                    </prop>
+                    <prop type="integer32" name="priority"/>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="delete" version="2026-07-21-preview" confirmation="Are you sure you want to perform this operation?">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.policyGroupName" options="name n" required="True" idPart="name">
+          <help short="The name of the PolicyGroup"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <operation operationId="PolicyGroups_Delete">
+        <longRunning finalStateVia="location"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}">
+          <request method="delete">
+            <path>
+              <param type="string" name="policyGroupName" arg="$Path.policyGroupName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+          </request>
+          <response statusCode="202">
+            <header>
+              <item name="Azure-AsyncOperation"/>
+              <item name="Location"/>
+              <item name="Retry-After"/>
+            </header>
+          </response>
+          <response statusCode="204"/>
+          <response statusCode="200 201"/>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+    </command>
+    <command name="create" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.policyGroupName" options="name n" required="True" idPart="name">
+          <help short="The name of the PolicyGroup"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg type="string" var="$resource.properties.description" options="description" group="Properties">
+          <help short="The description of the policy group."/>
+        </arg>
+        <arg type="string" var="$resource.properties.displayName" options="display-name" group="Properties">
+          <help short="The display name of the policy group."/>
+        </arg>
+        <arg type="array<object>" var="$resource.properties.networkSecurityPolicies" options="network-security-policies" group="Properties">
+          <help short="The list of network security policies."/>
+          <item type="object">
+            <arg type="object" var="$resource.properties.networkSecurityPolicies[].ContentInspection" options="content-inspection">
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection" options="prompt-injection-protection">
+                <help short="The prompt injection protection configuration."/>
+                <arg type="string" var="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.onDetection" options="on-detection" required="True">
+                  <help short="The action to take when prompt injection is detected."/>
+                  <enum>
+                    <item name="Alert" value="&quot;Alert&quot;"/>
+                    <item name="BlockAndAlert" value="&quot;BlockAndAlert&quot;"/>
+                    <item name="Sanitize" value="&quot;Sanitize&quot;"/>
+                  </enum>
+                </arg>
+                <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.promptLocations" options="prompt-locations">
+                  <help short="The JSONPath expressions selecting the parts of the request body to scan for prompt injection."/>
+                  <item type="string"/>
+                </arg>
+                <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.responseLocations" options="response-locations">
+                  <help short="The JSONPath expressions selecting the parts of the response body to scan for prompt injection."/>
+                  <item type="string"/>
+                </arg>
+                <arg type="string" var="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.sensitivity" options="sensitivity">
+                  <help short="The sensitivity level of prompt injection detection."/>
+                  <enum>
+                    <item name="High" value="&quot;High&quot;"/>
+                    <item name="Low" value="&quot;Low&quot;"/>
+                    <item name="Medium" value="&quot;Medium&quot;"/>
+                  </enum>
+                </arg>
+              </arg>
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].ContentInspection.source" options="source" required="True">
+                <help short="The source details for the policy."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes" options="address-prefixes">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes.prefixes" options="prefixes" required="True">
+                    <help short="The IP address prefixes, in CIDR notation, that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns" options="workload-id-patterns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns.patterns" options="patterns" required="True">
+                    <help short="The workload ID patterns that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+            </arg>
+            <arg type="object" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering" options="fqdn-filtering">
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination" options="destination">
+                <help short="The destination details for the policy."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns" options="fqdns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns.fqdns" options="fqdns" required="True">
+                    <help short="The fully qualified domain names that identify the destination(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+              <arg type="string" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.direction" options="direction">
+                <help short="The direction of traffic for the policy."/>
+                <enum>
+                  <item name="Both" value="&quot;Both&quot;"/>
+                  <item name="Inbound" value="&quot;Inbound&quot;"/>
+                  <item name="Outbound" value="&quot;Outbound&quot;"/>
+                </enum>
+              </arg>
+              <arg type="string" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.name" options="name">
+                <help short="The name of the policy."/>
+              </arg>
+              <arg type="array<integer32>" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.ports" options="ports">
+                <help short="The ports for the policy."/>
+                <item type="integer32"/>
+              </arg>
+              <arg type="integer32" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.priority" options="priority">
+                <help short="The priority of the policy."/>
+              </arg>
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source" options="source" required="True">
+                <help short="The source details for the policy."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes" options="address-prefixes">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes.prefixes" options="prefixes" required="True">
+                    <help short="The IP address prefixes, in CIDR notation, that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns" options="workload-id-patterns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns.patterns" options="patterns" required="True">
+                    <help short="The workload ID patterns that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+            </arg>
+            <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp" options="mcp">
+              <arg type="string" var="$resource.properties.networkSecurityPolicies[].Mcp.defaultAction" options="default-action" required="True">
+                <help short="The default action to take when no rule in the policy matches."/>
+                <enum>
+                  <item name="Allow" value="&quot;Allow&quot;"/>
+                  <item name="Deny" value="&quot;Deny&quot;"/>
+                </enum>
+              </arg>
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp.destination" options="destination" required="True">
+                <help short="The MCP server(s) that this policy applies to."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes" options="address-prefixes">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes.prefixes" options="prefixes" required="True">
+                    <help short="The IP address prefixes, in CIDR notation, that identify the destination(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns" options="fqdns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns.fqdns" options="fqdns" required="True">
+                    <help short="The fully qualified domain names that identify the destination(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns" options="workload-id-patterns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns.patterns" options="patterns" required="True">
+                    <help short="The workload ID patterns that identify the destination(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+              <arg type="array<object>" var="$resource.properties.networkSecurityPolicies[].Mcp.rules" options="rules" required="True">
+                <help short="The list of MCP rules."/>
+                <item type="object">
+                  <arg type="string" var="$resource.properties.networkSecurityPolicies[].Mcp.rules[].action" options="action" required="True">
+                    <help short="The action to take for the specified MCP tools."/>
+                    <enum>
+                      <item name="Allow" value="&quot;Allow&quot;"/>
+                      <item name="Deny" value="&quot;Deny&quot;"/>
+                    </enum>
+                  </arg>
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].Mcp.rules[].tools" options="tools" required="True">
+                    <help short="The MCP tool names that the rule applies to."/>
+                    <item type="string"/>
+                  </arg>
+                </item>
+              </arg>
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp.source" options="source" required="True">
+                <help short="The source(s) that this policy applies to."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes" options="address-prefixes">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes.prefixes" options="prefixes" required="True">
+                    <help short="The IP address prefixes, in CIDR notation, that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns" options="workload-id-patterns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns.patterns" options="patterns" required="True">
+                    <help short="The workload ID patterns that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+            </arg>
+            <arg type="object" var="$resource.properties.networkSecurityPolicies[].TlsInspection" options="tls-inspection">
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].TlsInspection.certificate" options="certificate" required="True">
+                <help short="The certificate configuration used for TLS inspection."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].TlsInspection.certificate.AzureManagedCA" options="azure-managed-ca">
+                  <blank value="{}"/>
+                </arg>
+              </arg>
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].TlsInspection.source" options="source" required="True">
+                <help short="The source details for the policy."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns" options="workload-id-patterns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns.patterns" options="patterns" required="True">
+                    <help short="The workload ID patterns that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+            </arg>
+            <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering" options="url-filtering">
+              <arg type="string" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.defaultAction" options="default-action" required="True">
+                <help short="The default action to take when no rule in the policy matches."/>
+                <enum>
+                  <item name="Allow" value="&quot;Allow&quot;"/>
+                  <item name="Deny" value="&quot;Deny&quot;"/>
+                </enum>
+              </arg>
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination" options="destination">
+                <help short="The destination details for the policy."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes" options="address-prefixes">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes.prefixes" options="prefixes" required="True">
+                    <help short="The IP address prefixes, in CIDR notation, that identify the destination(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns" options="fqdns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns.fqdns" options="fqdns" required="True">
+                    <help short="The fully qualified domain names that identify the destination(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns" options="workload-id-patterns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns.patterns" options="patterns" required="True">
+                    <help short="The workload ID patterns that identify the destination(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+              <arg type="array<object>" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules" options="rules" required="True">
+                <help short="The list of URL filtering rules."/>
+                <item type="object">
+                  <arg type="string" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].action" options="action" required="True">
+                    <help short="The action to take when the rule matches."/>
+                    <enum>
+                      <item name="Allow" value="&quot;Allow&quot;"/>
+                      <item name="Deny" value="&quot;Deny&quot;"/>
+                    </enum>
+                  </arg>
+                  <arg type="string" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].hostname" options="hostname">
+                    <help short="The hostname matched by the rule. If omitted, the rule matches any hostname."/>
+                  </arg>
+                  <arg type="string" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].method" options="method">
+                    <help short="The HTTP method matched by the rule. If omitted, the rule matches any method."/>
+                    <enum>
+                      <item name="DELETE" value="&quot;DELETE&quot;"/>
+                      <item name="GET" value="&quot;GET&quot;"/>
+                      <item name="HEAD" value="&quot;HEAD&quot;"/>
+                      <item name="OPTIONS" value="&quot;OPTIONS&quot;"/>
+                      <item name="PATCH" value="&quot;PATCH&quot;"/>
+                      <item name="POST" value="&quot;POST&quot;"/>
+                      <item name="PUT" value="&quot;PUT&quot;"/>
+                    </enum>
+                  </arg>
+                  <arg type="string" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].name" options="name" required="True">
+                    <help short="The name of the rule."/>
+                  </arg>
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].paths" options="paths">
+                    <help short="The URL paths matched by the rule. If omitted, the rule matches any path."/>
+                    <item type="string"/>
+                  </arg>
+                  <arg type="integer32" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].priority" options="priority" required="True">
+                    <help short="The priority of the rule. Rules are evaluated in ascending priority order."/>
+                  </arg>
+                </item>
+              </arg>
+              <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.source" options="source" required="True">
+                <help short="The source details for the policy."/>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes" options="address-prefixes">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes.prefixes" options="prefixes" required="True">
+                    <help short="The IP address prefixes, in CIDR notation, that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+                <arg type="object" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns" options="workload-id-patterns">
+                  <arg type="array<string>" var="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns.patterns" options="patterns" required="True">
+                    <help short="The workload ID patterns that identify the source(s)."/>
+                    <item type="string"/>
+                  </arg>
+                </arg>
+              </arg>
+            </arg>
+          </item>
+        </arg>
+        <arg type="integer32" var="$resource.properties.priority" options="priority" group="Properties">
+          <help short="The priority of the policy group."/>
+        </arg>
+      </argGroup>
+      <argGroup name="Resource">
+        <arg type="ResourceLocation" var="$resource.location" options="location l" required="True" group="Resource">
+          <help short="The geo-location where the resource lives"/>
+        </arg>
+        <arg type="object" var="$resource.tags" options="tags" group="Resource">
+          <help short="Resource tags."/>
+          <additionalProp>
+            <item type="string"/>
+          </additionalProp>
+        </arg>
+      </argGroup>
+      <operation operationId="PolicyGroups_CreateOrUpdate">
+        <longRunning finalStateVia="azure-async-operation"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}">
+          <request method="put">
+            <path>
+              <param type="string" name="policyGroupName" arg="$Path.policyGroupName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json>
+                <schema type="object" name="resource" required="True" clientFlatten="True">
+                  <prop type="ResourceLocation" name="location" arg="$resource.location" required="True"/>
+                  <prop type="object" name="properties">
+                    <prop type="string" name="description" arg="$resource.properties.description"/>
+                    <prop type="string" name="displayName" arg="$resource.properties.displayName"/>
+                    <prop type="array<object>" name="networkSecurityPolicies" arg="$resource.properties.networkSecurityPolicies">
+                      <item type="object">
+                        <prop type="string" name="type" required="True">
+                          <enum>
+                            <item arg="$resource.properties.networkSecurityPolicies[].ContentInspection" value="&quot;ContentInspection&quot;"/>
+                            <item arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering" value="&quot;FqdnFiltering&quot;"/>
+                            <item arg="$resource.properties.networkSecurityPolicies[].Mcp" value="&quot;Mcp&quot;"/>
+                            <item arg="$resource.properties.networkSecurityPolicies[].TlsInspection" value="&quot;TlsInspection&quot;"/>
+                            <item arg="$resource.properties.networkSecurityPolicies[].UrlFiltering" value="&quot;UrlFiltering&quot;"/>
+                          </enum>
+                        </prop>
+                        <discriminator property="type" value="ContentInspection">
+                          <prop type="object" name="promptInjectionProtection" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection">
+                            <prop type="string" name="onDetection" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.onDetection" required="True">
+                              <enum>
+                                <item value="&quot;Alert&quot;"/>
+                                <item value="&quot;BlockAndAlert&quot;"/>
+                                <item value="&quot;Sanitize&quot;"/>
+                              </enum>
+                            </prop>
+                            <prop type="array<string>" name="promptLocations" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.promptLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="array<string>" name="responseLocations" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.responseLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="string" name="sensitivity" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.promptInjectionProtection.sensitivity">
+                              <enum>
+                                <item value="&quot;High&quot;"/>
+                                <item value="&quot;Low&quot;"/>
+                                <item value="&quot;Medium&quot;"/>
+                              </enum>
+                            </prop>
+                          </prop>
+                          <prop type="object" name="source" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes" value="&quot;AddressPrefixes&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns" value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.source.AddressPrefixes.prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" arg="$resource.properties.networkSecurityPolicies[].ContentInspection.source.WorkloadIdPatterns.patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="FqdnFiltering">
+                          <prop type="object" name="destination" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns" value="&quot;Fqdns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.destination.Fqdns.fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="string" name="direction" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.direction">
+                            <enum>
+                              <item value="&quot;Both&quot;"/>
+                              <item value="&quot;Inbound&quot;"/>
+                              <item value="&quot;Outbound&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="name" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.name"/>
+                          <prop type="array<integer32>" name="ports" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.ports">
+                            <item type="integer32"/>
+                          </prop>
+                          <prop type="integer32" name="priority" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.priority"/>
+                          <prop type="object" name="source" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes" value="&quot;AddressPrefixes&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns" value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.AddressPrefixes.prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" arg="$resource.properties.networkSecurityPolicies[].FqdnFiltering.source.WorkloadIdPatterns.patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="Mcp">
+                          <prop type="string" name="defaultAction" arg="$resource.properties.networkSecurityPolicies[].Mcp.defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination" arg="$resource.properties.networkSecurityPolicies[].Mcp.destination" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes" value="&quot;AddressPrefixes&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns" value="&quot;Fqdns&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns" value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" arg="$resource.properties.networkSecurityPolicies[].Mcp.destination.AddressPrefixes.prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" arg="$resource.properties.networkSecurityPolicies[].Mcp.destination.Fqdns.fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" arg="$resource.properties.networkSecurityPolicies[].Mcp.destination.WorkloadIdPatterns.patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" arg="$resource.properties.networkSecurityPolicies[].Mcp.rules" required="True">
+                            <item type="object">
+                              <prop type="string" name="action" arg="$resource.properties.networkSecurityPolicies[].Mcp.rules[].action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="array<string>" name="tools" arg="$resource.properties.networkSecurityPolicies[].Mcp.rules[].tools" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" arg="$resource.properties.networkSecurityPolicies[].Mcp.source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes" value="&quot;AddressPrefixes&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns" value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" arg="$resource.properties.networkSecurityPolicies[].Mcp.source.AddressPrefixes.prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" arg="$resource.properties.networkSecurityPolicies[].Mcp.source.WorkloadIdPatterns.patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="TlsInspection">
+                          <prop type="object" name="certificate" arg="$resource.properties.networkSecurityPolicies[].TlsInspection.certificate" required="True">
+                            <prop type="string" name="mode" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].TlsInspection.certificate.AzureManagedCA" value="&quot;AzureManagedCA&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="mode" value="AzureManagedCA"/>
+                          </prop>
+                          <prop type="object" name="source" arg="$resource.properties.networkSecurityPolicies[].TlsInspection.source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns" value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" arg="$resource.properties.networkSecurityPolicies[].TlsInspection.source.WorkloadIdPatterns.patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="UrlFiltering">
+                          <prop type="string" name="defaultAction" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes" value="&quot;AddressPrefixes&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns" value="&quot;Fqdns&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns" value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.AddressPrefixes.prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.Fqdns.fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.destination.WorkloadIdPatterns.patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules" required="True" identifiers="name">
+                            <item type="object">
+                              <prop type="string" name="action" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="hostname" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].hostname"/>
+                              <prop type="string" name="method" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].method">
+                                <enum>
+                                  <item value="&quot;DELETE&quot;"/>
+                                  <item value="&quot;GET&quot;"/>
+                                  <item value="&quot;HEAD&quot;"/>
+                                  <item value="&quot;OPTIONS&quot;"/>
+                                  <item value="&quot;PATCH&quot;"/>
+                                  <item value="&quot;POST&quot;"/>
+                                  <item value="&quot;PUT&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="name" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].name" required="True"/>
+                              <prop type="array<string>" name="paths" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].paths">
+                                <item type="string"/>
+                              </prop>
+                              <prop type="integer32" name="priority" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.rules[].priority" required="True"/>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes" value="&quot;AddressPrefixes&quot;"/>
+                                <item arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns" value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.AddressPrefixes.prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" arg="$resource.properties.networkSecurityPolicies[].UrlFiltering.source.WorkloadIdPatterns.patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                      </item>
+                    </prop>
+                    <prop type="integer32" name="priority" arg="$resource.properties.priority"/>
+                  </prop>
+                  <prop type="object" name="tags" arg="$resource.tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </request>
+          <response statusCode="200 201">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="string" name="description"/>
+                    <prop type="string" name="displayName"/>
+                    <prop type="array<object>" name="networkSecurityPolicies">
+                      <item type="object">
+                        <prop type="string" name="type" required="True">
+                          <enum>
+                            <item value="&quot;ContentInspection&quot;"/>
+                            <item value="&quot;FqdnFiltering&quot;"/>
+                            <item value="&quot;Mcp&quot;"/>
+                            <item value="&quot;TlsInspection&quot;"/>
+                            <item value="&quot;UrlFiltering&quot;"/>
+                          </enum>
+                        </prop>
+                        <discriminator property="type" value="ContentInspection">
+                          <prop type="object" name="promptInjectionProtection">
+                            <prop type="string" name="onDetection" required="True">
+                              <enum>
+                                <item value="&quot;Alert&quot;"/>
+                                <item value="&quot;BlockAndAlert&quot;"/>
+                                <item value="&quot;Sanitize&quot;"/>
+                              </enum>
+                            </prop>
+                            <prop type="array<string>" name="promptLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="array<string>" name="responseLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="string" name="sensitivity">
+                              <enum>
+                                <item value="&quot;High&quot;"/>
+                                <item value="&quot;Low&quot;"/>
+                                <item value="&quot;Medium&quot;"/>
+                              </enum>
+                            </prop>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="FqdnFiltering">
+                          <prop type="object" name="destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;Fqdns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="string" name="direction">
+                            <enum>
+                              <item value="&quot;Both&quot;"/>
+                              <item value="&quot;Inbound&quot;"/>
+                              <item value="&quot;Outbound&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="name"/>
+                          <prop type="array<integer32>" name="ports">
+                            <item type="integer32"/>
+                          </prop>
+                          <prop type="integer32" name="priority"/>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="Mcp">
+                          <prop type="string" name="defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;Fqdns&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" required="True">
+                            <item type="object">
+                              <prop type="string" name="action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="array<string>" name="tools" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="TlsInspection">
+                          <prop type="object" name="certificate" required="True">
+                            <prop type="string" name="mode" required="True">
+                              <enum>
+                                <item value="&quot;AzureManagedCA&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="mode" value="AzureManagedCA"/>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="UrlFiltering">
+                          <prop type="string" name="defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;Fqdns&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" required="True" identifiers="name">
+                            <item type="object">
+                              <prop type="string" name="action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="hostname"/>
+                              <prop type="string" name="method">
+                                <enum>
+                                  <item value="&quot;DELETE&quot;"/>
+                                  <item value="&quot;GET&quot;"/>
+                                  <item value="&quot;HEAD&quot;"/>
+                                  <item value="&quot;OPTIONS&quot;"/>
+                                  <item value="&quot;PATCH&quot;"/>
+                                  <item value="&quot;POST&quot;"/>
+                                  <item value="&quot;PUT&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="name" required="True"/>
+                              <prop type="array<string>" name="paths">
+                                <item type="string"/>
+                              </prop>
+                              <prop type="integer32" name="priority" required="True"/>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                      </item>
+                    </prop>
+                    <prop type="integer32" name="priority"/>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+    <command name="update" version="2026-07-21-preview">
+      <resource id="/subscriptions/{}/resourcegroups/{}/providers/microsoft.networksecurity/policygroups/{}" version="2026-07-21-preview" swagger="mgmt-plane/networksecurity/ResourceProviders/Microsoft.NetworkSecurity/Paths/L3N1YnNjcmlwdGlvbnMve3N1YnNjcmlwdGlvbklkfS9yZXNvdXJjZUdyb3Vwcy97cmVzb3VyY2VHcm91cE5hbWV9L3Byb3ZpZGVycy9NaWNyb3NvZnQuTmV0d29ya1NlY3VyaXR5L3BvbGljeUdyb3Vwcy97cG9saWN5R3JvdXBOYW1lfQ==/V/MjAyNi0wNy0yMS1wcmV2aWV3"/>
+      <argGroup name="">
+        <arg type="string" var="$Path.policyGroupName" options="name n" required="True" idPart="name">
+          <help short="The name of the PolicyGroup"/>
+          <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+        </arg>
+        <arg type="ResourceGroupName" var="$Path.resourceGroupName" options="resource-group g" required="True" idPart="resource_group"/>
+        <arg type="SubscriptionId" var="$Path.subscriptionId" options="subscription" required="True" idPart="subscription"/>
+      </argGroup>
+      <argGroup name="Properties">
+        <arg type="object" var="$properties.tags" options="tags" group="Properties">
+          <help short="Resource tags."/>
+          <additionalProp>
+            <item type="string"/>
+          </additionalProp>
+        </arg>
+      </argGroup>
+      <operation operationId="PolicyGroups_Update">
+        <longRunning finalStateVia="location"/>
+        <http path="/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.NetworkSecurity/policyGroups/{policyGroupName}">
+          <request method="patch">
+            <path>
+              <param type="string" name="policyGroupName" arg="$Path.policyGroupName" required="True">
+                <format pattern="^[a-zA-Z0-9-]{3,24}$"/>
+              </param>
+              <param type="string" name="resourceGroupName" arg="$Path.resourceGroupName" required="True">
+                <format maxLength="90" minLength="1"/>
+              </param>
+              <param type="uuid" name="subscriptionId" arg="$Path.subscriptionId" required="True"/>
+            </path>
+            <query>
+              <const readOnly="True" const="True" type="string" name="api-version" required="True">
+                <default value="&quot;2026-07-21-preview&quot;"/>
+                <format minLength="1"/>
+              </const>
+            </query>
+            <body>
+              <json>
+                <schema type="object" name="properties" required="True" clientFlatten="True">
+                  <prop type="object" name="tags" arg="$properties.tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                </schema>
+              </json>
+            </body>
+          </request>
+          <response statusCode="200">
+            <body>
+              <json var="$Instance">
+                <schema type="object">
+                  <prop readOnly="True" type="ResourceId" name="id">
+                    <format template="/subscriptions/{}/resourceGroups/{}/providers/Microsoft.NetworkSecurity/policyGroups/{}"/>
+                  </prop>
+                  <prop type="ResourceLocation" name="location" required="True"/>
+                  <prop readOnly="True" type="string" name="name"/>
+                  <prop type="object" name="properties">
+                    <prop type="string" name="description"/>
+                    <prop type="string" name="displayName"/>
+                    <prop type="array<object>" name="networkSecurityPolicies">
+                      <item type="object">
+                        <prop type="string" name="type" required="True">
+                          <enum>
+                            <item value="&quot;ContentInspection&quot;"/>
+                            <item value="&quot;FqdnFiltering&quot;"/>
+                            <item value="&quot;Mcp&quot;"/>
+                            <item value="&quot;TlsInspection&quot;"/>
+                            <item value="&quot;UrlFiltering&quot;"/>
+                          </enum>
+                        </prop>
+                        <discriminator property="type" value="ContentInspection">
+                          <prop type="object" name="promptInjectionProtection">
+                            <prop type="string" name="onDetection" required="True">
+                              <enum>
+                                <item value="&quot;Alert&quot;"/>
+                                <item value="&quot;BlockAndAlert&quot;"/>
+                                <item value="&quot;Sanitize&quot;"/>
+                              </enum>
+                            </prop>
+                            <prop type="array<string>" name="promptLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="array<string>" name="responseLocations">
+                              <item type="string"/>
+                            </prop>
+                            <prop type="string" name="sensitivity">
+                              <enum>
+                                <item value="&quot;High&quot;"/>
+                                <item value="&quot;Low&quot;"/>
+                                <item value="&quot;Medium&quot;"/>
+                              </enum>
+                            </prop>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="FqdnFiltering">
+                          <prop type="object" name="destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;Fqdns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="string" name="direction">
+                            <enum>
+                              <item value="&quot;Both&quot;"/>
+                              <item value="&quot;Inbound&quot;"/>
+                              <item value="&quot;Outbound&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="string" name="name"/>
+                          <prop type="array<integer32>" name="ports">
+                            <item type="integer32"/>
+                          </prop>
+                          <prop type="integer32" name="priority"/>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="Mcp">
+                          <prop type="string" name="defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;Fqdns&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" required="True">
+                            <item type="object">
+                              <prop type="string" name="action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="array<string>" name="tools" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="TlsInspection">
+                          <prop type="object" name="certificate" required="True">
+                            <prop type="string" name="mode" required="True">
+                              <enum>
+                                <item value="&quot;AzureManagedCA&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="mode" value="AzureManagedCA"/>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                        <discriminator property="type" value="UrlFiltering">
+                          <prop type="string" name="defaultAction" required="True">
+                            <enum>
+                              <item value="&quot;Allow&quot;"/>
+                              <item value="&quot;Deny&quot;"/>
+                            </enum>
+                          </prop>
+                          <prop type="object" name="destination">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;Fqdns&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="Fqdns">
+                              <prop type="array<string>" name="fqdns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                          <prop type="array<object>" name="rules" required="True" identifiers="name">
+                            <item type="object">
+                              <prop type="string" name="action" required="True">
+                                <enum>
+                                  <item value="&quot;Allow&quot;"/>
+                                  <item value="&quot;Deny&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="hostname"/>
+                              <prop type="string" name="method">
+                                <enum>
+                                  <item value="&quot;DELETE&quot;"/>
+                                  <item value="&quot;GET&quot;"/>
+                                  <item value="&quot;HEAD&quot;"/>
+                                  <item value="&quot;OPTIONS&quot;"/>
+                                  <item value="&quot;PATCH&quot;"/>
+                                  <item value="&quot;POST&quot;"/>
+                                  <item value="&quot;PUT&quot;"/>
+                                </enum>
+                              </prop>
+                              <prop type="string" name="name" required="True"/>
+                              <prop type="array<string>" name="paths">
+                                <item type="string"/>
+                              </prop>
+                              <prop type="integer32" name="priority" required="True"/>
+                            </item>
+                          </prop>
+                          <prop type="object" name="source" required="True">
+                            <prop type="string" name="type" required="True">
+                              <enum>
+                                <item value="&quot;AddressPrefixes&quot;"/>
+                                <item value="&quot;WorkloadIdPatterns&quot;"/>
+                              </enum>
+                            </prop>
+                            <discriminator property="type" value="AddressPrefixes">
+                              <prop type="array<string>" name="prefixes" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                            <discriminator property="type" value="WorkloadIdPatterns">
+                              <prop type="array<string>" name="patterns" required="True">
+                                <item type="string"/>
+                              </prop>
+                            </discriminator>
+                          </prop>
+                        </discriminator>
+                      </item>
+                    </prop>
+                    <prop type="integer32" name="priority"/>
+                    <prop readOnly="True" type="string" name="provisioningState">
+                      <enum>
+                        <item value="&quot;Accepted&quot;"/>
+                        <item value="&quot;Canceled&quot;"/>
+                        <item value="&quot;Deleting&quot;"/>
+                        <item value="&quot;Failed&quot;"/>
+                        <item value="&quot;Provisioning&quot;"/>
+                        <item value="&quot;Succeeded&quot;"/>
+                        <item value="&quot;Updating&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop readOnly="True" type="object" name="systemData">
+                    <prop type="dateTime" name="createdAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="createdBy"/>
+                    <prop type="string" name="createdByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                    <prop type="dateTime" name="lastModifiedAt">
+                      <format protocol="iso"/>
+                    </prop>
+                    <prop type="string" name="lastModifiedBy"/>
+                    <prop type="string" name="lastModifiedByType">
+                      <enum>
+                        <item value="&quot;Application&quot;"/>
+                        <item value="&quot;Key&quot;"/>
+                        <item value="&quot;ManagedIdentity&quot;"/>
+                        <item value="&quot;User&quot;"/>
+                      </enum>
+                    </prop>
+                  </prop>
+                  <prop type="object" name="tags">
+                    <additionalProp>
+                      <item type="string"/>
+                    </additionalProp>
+                  </prop>
+                  <prop readOnly="True" type="string" name="type"/>
+                </schema>
+              </json>
+            </body>
+          </response>
+          <response statusCode="202">
+            <header>
+              <item name="Location"/>
+              <item name="Retry-After"/>
+            </header>
+          </response>
+          <response isError="True">
+            <body>
+              <json>
+                <schema type="@MgmtErrorFormat"/>
+              </json>
+            </body>
+          </response>
+        </http>
+      </operation>
+      <output type="object" ref="$Instance" clientFlatten="True"/>
+    </command>
+  </commandGroup>
+</CodeGen>