The latest Azure CLI release (`2.89.1`) still generates the parent Application Gateway GET command with API version `2024-10-01`

[srijanee]

Describe the bug

az network application-gateway show

Managed HSM support for Application Gateway SSL certificates was added in API version 2025-07-01 and implemented for the SSL certificate command group under #33263. The SSL certificate commands correctly use 2025-07-01, but the parent Application Gateway GET remains pinned to 2024-10-01.

As a result, retrieving the complete Application Gateway resource through the parent show command can omit the Managed HSM properties under sslCertificates[].properties.hsm.

HSM PR: #33263

Related command

az network application-gateway show \
  --resource-group <resource-group> \
  --name <application-gateway> \
  --debug

Errors

There is no CLI exception. The problem is the API version selected for the parent GET request and the resulting response shape.

• Actual parent GET API version: 2024-10-01
• Minimum API version containing ApplicationGatewayManagedHsm: 2025-07-01

Issue script & Debug output

The sanitized parent GET request shown by --debug uses:

GET https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Network/applicationGateways/<application-gateway>?api-version=2024-10-01

The generated AAZ source in release azure-cli-2.89.1 confirms the mismatch:

• src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_show.py
  • _aaz_info["version"] = "2024-10-01"
  • ApplicationGatewaysGet uses 2024-10-01
• src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/ssl_cert/_show.py
  • _aaz_info["version"] = "2025-07-01"
  • The response schema includes hsm.keyId and hsm.publicCertData

The same parent/child API-version mismatch exists for generated Application Gateway create/update versus SSL certificate create/update. Those operations should also be assessed for read-modify-write behavior that could omit HSM properties.

Expected behavior

az network application-gateway show should use an API version that supports Managed HSM, at minimum 2025-07-01, and return these fields when configured:

sslCertificates[].properties.hsm.keyId
sslCertificates[].properties.hsm.publicCertData

Please also verify that parent Application Gateway create/update operations cannot omit or overwrite Managed HSM SSL certificate properties because they use the older API version.

Regression coverage should verify:

1. The parent Application Gateway GET request uses the intended API version.
2. Managed HSM fields are preserved in the returned model.
3. Parent create/update read-modify-write flows preserve HSM-backed SSL certificate configuration.

Environment Summary

azure-cli 2.89.1

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[x-engineering-agent]

Bug Analysis

az network application-gateway show (and likely the generated parent
create/update operations) issue their GET/PUT requests against API version
2024-10-01, while the sibling SSL-certificate command group
(az network application-gateway ssl-cert ..., added in #33263) correctly
uses 2025-07-01, the minimum version that returns/accepts the Managed HSM
hsm.keyId / hsm.publicCertData properties on
sslCertificates[].properties.

Because the parent resource is generated from an older AAZ command model
version, retrieving the full Application Gateway through the parent show
(and any parent create/update read-modify-write flow) can omit or drop the
Managed HSM SSL certificate fields even though the certificate-level commands
already handle them.

Affected generated sources (regenerate rather than hand-edit; the durable
source lives in Azure/aaz):

• src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_show.py
  (_aaz_info["version"] = "2024-10-01")
• src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_create.py /
  _update.py (and any other parent-resource operations) if they use the
  same stale version.

Related command
az network application-gateway show

Fix
Regenerate/bump the parent application_gateway AAZ command-model
operations (show, and create/update if affected) to API version
2025-07-01 (or later) so the response/request schema includes the Managed
HSM SSL certificate fields, matching the ssl_cert sub-group. Confirm the
read-modify-write path for create/update does not drop or overwrite
sslCertificates[].properties.hsm.* when round-tripping through the parent
model.

Testing Guide

• Add/extend regression coverage (recording or unit test) asserting the
  parent GET request uses API version 2025-07-01+ and that
  sslCertificates[].properties.hsm.keyId /
  hsm.publicCertData survive a show call when the certificate is
  Managed-HSM backed.
• Verify a create/update round trip does not clear the HSM-backed
  certificate properties.

Use this EXACT PR title: [Network] Fix #33981: az network application-gateway show: Bump parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Use this EXACT PR title (copy verbatim, do not reword):

[Network] Fix #33981: `az network application-gateway show`: Bump parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved

Keep the backticks around the command and the Fix #33981: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [Network] prefix, issue link, and backticked command must stay.

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #33981.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Network] `az <command>`: <note>.
• Keep the template checklist and tick the items you've satisfied.

[x-engineering-agent]

Started a Copilot task in a0x1ab/azure-cli using claude-sonnet-4.6: https://github.com/a0x1ab/azure-cli/tasks/04b50bda-d5f0-49ea-952e-aebf09867f26

[necusjz]

the pr from agent doesn't touch codegen -> not valid.

[necusjz]

srijanee az network application-gateway ssl-cert show -h is supposed to be work, correct?