%3CLINGO-SUB%20id%3D%22lingo-sub-1540306%22%20slang%3D%22en-US%22%3EHow%20to%20manage%20Azure%20resources%20with%20the%20new%20PowerShell%20Invoke-AzRestMethod%20cmdlet%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1540306%22%20slang%3D%22en-US%22%3E%3CP%3E%60Invoke-AzRestMethod%60%20is%20a%20new%20Azure%20PowerShell%20cmdlet.%20It%20allows%20you%20to%20make%20custom%20HTTP%20requests%20to%20the%20Azure%20Resource%20Management%20(ARM)%20endpoint%20using%20the%20Az%20context.%3C%2FP%3E%0A%3CP%3EThis%20cmdlet%20is%20useful%20when%20you%20want%20to%20manage%20Azure%20services%20for%20features%20that%20aren%E2%80%99t%20yet%20available%20in%20the%20Az%20PowerShell%20modules.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1298252780%22%20id%3D%22toc-hId--1298252780%22%3EHow%20to%20use%20Invoke-AzRestMethod%3F%3C%2FH2%3E%0A%3CP%3EAs%20an%20example%2C%20you%20can%20allow%20access%20to%20Azure%20Container%20Registry%20(ACR)%20only%20for%20specific%20networks%20or%20deny%20public%20access.%20This%20feature%20isn%E2%80%99t%20available%20yet%20in%20the%20Az.ContainerRegistry%20PowerShell%20module.%20However%2C%20it%20can%20be%20managed%20in%20the%20interim%20with%20%60Invoke-AzRestMethod%60.%3C%2FP%3E%0A%3CP%3EWe%20want%20to%20disable%20public%20access%20to%20the%20existing%20ACR%20named%20%60ameacr%60%20in%20the%20%60amedemo%60%20resource%20group.%20Let%E2%80%99s%20start%20by%20understanding%20how%20the%20cmdlet%20works%20with%20a%20GET%20operation%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EInvoke-AzRestMethod%3CBR%20%2F%3E-ResourceGroupName%20%E2%80%9Camedemo%E2%80%9D%3CBR%20%2F%3E-ResourceProviderName%20%22Microsoft.ContainerRegistry%22%3CBR%20%2F%3E-ResourceType%20%E2%80%9Cregistries%E2%80%9D%3CBR%20%2F%3E-Name%20%E2%80%9Cameacr%E2%80%9D%3CBR%20%2F%3E-ApiVersion%202019-12-01-preview%3CBR%20%2F%3E-Method%20GET%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Invoke-AzRest-GET.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F207371i1E53244C1A95DA8F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Invoke-AzRest-GET.png%22%20alt%3D%22Invoke-AzRest-GET.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ETo%20allow%20maximum%20flexibility%2C%20most%20of%20the%20parameters%20are%20optional.%20However%2C%20when%20you%E2%80%99re%20managing%20resources%20within%20a%20resource%20group%2C%20you%E2%80%99ll%20most%20likely%20need%20to%20provide%20either%20the%20full%20ID%20to%20the%20resource%20or%20parameters%20like%20resource%20group%2C%20resource%20provider%20and%20resource%20type.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EThe%20'%3CSTRONG%3EResourceType%3C%2FSTRONG%3E'%20and%20'%3CSTRONG%3EName%3C%2FSTRONG%3E'%20parameters%20can%20take%20multiple%20values%20when%20targeting%20resources%20that%20require%20more%20than%20one%20name.%20For%20example%2C%20to%20manipulate%20a%20saved%20search%20in%20a%20Log%20Analytics%20workspace%2C%20the%20parameters%20look%20like%20the%20following%3A%3C%2FP%3E%0A%3CP%3E%E2%80%98-ResourceType%20%40('workspaces'%2C%20'savedsearches')%20-Name%20%40('ame-la'%2C%20'ame-search')%E2%80%99%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EUsing%20a%20mapping%20based%20on%20the%20position%20in%20the%20array%2C%20the%20cmdlet%20constructs%20the%20following%20resource%20Id%3A%E2%80%98%2Fworkspaces%2Fyabo-test-la%2Fsavedsearches%2Fame-search%E2%80%99.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20%E2%80%98APIVersion%E2%80%99%20parameter%20allows%20you%20to%20use%20a%20specific%20API%2C%20including%20preview%20ones%20as%20it%20is%20the%20case%20here.%20The%20supported%20API%20versions%20for%20Azure%20Resource%20providers%20can%20be%20found%20in%20the%20following%20repository%3A%20-ERR%3AREF-NOT-FOUND-%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2Fazure-rest-api-specs%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2Fazure-rest-api-specs%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20find%20the%20definition%20for%20the%202019-12-01-preview%20version%20of%20ACR%20at%20the%20following%20location%3A%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2Fazure-rest-api-specs%2Ftree%2Fmaster%2Fspecification%2Fcontainerregistry%2Fresource-manager%2FMicrosoft.ContainerRegistry%2Fpreview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2Fazure-rest-api-specs%2Ftree%2Fmaster%2Fspecification%2Fcontainerregistry%2Fresource-manager%2FMicrosoft.ContainerRegistry%2Fpreview%3C%2FA%3E%20%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3ETo%20disable%20the%20public%20network%20access%2C%20we%20need%20to%20make%20a%20PATCH%20call%20to%20the%20API%20that%20changes%20the%20value%20of%20the%20%E2%80%9C%3CSTRONG%3EpublicNetwokAccess%3C%2FSTRONG%3E%E2%80%9D%20parameter%3A%3C%2FP%3E%0A%3CPRE%3EInvoke-AzRestMethod%3CBR%20%2F%3E%20%20-ResourceGroupName%20amedemo%20%3CBR%20%2F%3E%20%20-Name%20%22ameacr%22%20%3CBR%20%2F%3E%20%20-ResourceProviderName%20%22Microsoft.ContainerRegistry%22%20%3CBR%20%2F%3E%20%20-ResourceType%20%22registries%22%20%3CBR%20%2F%3E%20%20-ApiVersion%202019-12-01-preview%20%3CBR%20%2F%3E%20%20-Payload%20'%7B%20%22properties%22%3A%20%7B%3CBR%20%2F%3E%20%20%20%20%20%22publicNetworkAccess%22%3A%20%22Disabled%22%3CBR%20%2F%3E%20%20%20%20%20%7D%20%7D'%20%3CBR%20%2F%3E%20%20-Method%20PATCH%3C%2FPRE%3E%0A%3CP%3EThe%20Payload%20property%20is%20a%20JSON%20string%20that%20shows%20the%20path%20of%20the%20property%20to%20be%20modified.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Invoke-AzRest-PATCH.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F207363i31D89B2EA205D320%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Invoke-AzRest-PATCH.png%22%20alt%3D%22Invoke-AzRest-PATCH.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EAll%20the%20parameters%20for%20this%20API%20are%20described%20in%20the%20rest-api-spec%20file%20associated%20with%20this%20API.%20More%20specifically%2C%20the%20definition%20for%20the%20publicNetworkAccess%20parameter%20can%20be%20found%20in%20the%20following%20JSON%20file%3A%20-ERR%3AREF-NOT-FOUND-%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2Fazure-rest-api-specs%2Fblob%2F2a9da9a79d0a7b74089567ec4f0289f3e0f31bec%2Fspecification%2Fcontainerregistry%2Fresource-manager%2FMicrosoft.ContainerRegistry%2Fpreview%2F2019-12-01-preview%2Fcontainerregistry.json%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2Fazure-rest-api-specs%2Fblob%2F2a9da9a79d0a7b74089567ec4f0289f3e0f31bec%2Fspecification%2Fcontainerregistry%2Fresource-manager%2FMicrosoft.ContainerRegistry%2Fpreview%2F2019-12-01-preview%2Fcontainerregistry.json%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20only%20allow%20access%20to%20the%20registry%20from%20a%20specific%20IP%20address%2C%20the%20payload%20needs%20to%20be%20adjusted%20as%20follows%3A%3C%2FP%3E%0A%3CPRE%3EInvoke-AzRestMethod%3CBR%20%2F%3E%20%20-ResourceGroupName%20amedemo%3CBR%20%2F%3E%20%20-Name%20%22ameacr%22%3CBR%20%2F%3E%20%20-ResourceProviderName%20%22Microsoft.ContainerRegistry%22%3CBR%20%2F%3E%20%20-ResourceType%20%22registries%22%3CBR%20%2F%3E%20%20-ApiVersion%202019-12-01-preview%3CBR%20%2F%3E%20%20-Payload%20'%7B%20%22properties%22%3A%20%7B%3CBR%20%2F%3E%20%20%20%20%20%20%22networkRuleSet%22%3A%20%7B%3CBR%20%2F%3E%20%20%20%20%20%20%22defaultAction%22%3A%20%22Deny%22%2C%3CBR%20%2F%3E%20%20%20%20%20%20%22ipRules%22%3A%20%5B%20%7B%3CBR%20%2F%3E%20%20%20%20%20%20%20%20%20%22action%22%3A%20%22Allow%22%2C%3CBR%20%2F%3E%20%20%20%20%20%20%20%20%20%22value%22%3A%20%2224.22.123.123%22%3CBR%20%2F%3E%20%20%20%20%20%20%20%20%20%7D%20%5D%3CBR%20%2F%3E%20%20%20%20%20%20%7D%3CBR%20%2F%3E%20%20%7D%20%7D'%20%3CBR%20%2F%3E%20%20-Method%20PATCH%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Invoke-AzRest-PATCH-CustomIP.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F207365iCC439008D4F5B9E5%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Invoke-AzRest-PATCH-CustomIP.png%22%20alt%3D%22Invoke-AzRest-PATCH-CustomIP.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1189260053%22%20id%3D%22toc-hId-1189260053%22%3EHow%20does%20this%20compare%20to%20the%20(New%7CGet%7CSet)-AzResource%3F%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20*-AzResource%20cmdlets%20allow%20you%20to%20customize%20the%20REST%20API%20call%20to%20Azure%20by%20specifying%20the%20resource%20type%2C%20the%20API%20version%2C%20and%20the%20properties%20to%20be%20updated.%20However%2C%20the%20properties%20need%20to%20be%20a%20PSObject%20which%20can%20easily%20become%20complicated%20to%20create.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EWith%20%60Invoke-AzRestMethod%60%2C%20we%20wanted%20to%20offer%20a%20simpler%20way%20to%20manage%20Azure%20resources.%20In%20the%20previous%20example%2C%20you%20can%20see%20that%20the%20payload%20is%20a%20JSON%20string.%20You%20don%E2%80%99t%20have%20to%20struggle%20with%20the%20conversion%20between%20JSON%20and%20PSObjects.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EIf%20you%E2%80%99re%20already%20familiar%20with%20the%20*-AzResource%20cmdlets%2C%20you%20can%20continue%20using%20them.%20We%20have%20no%20plans%20to%20stop%20supporting%20them.%20With%20%60Invoke-AzRestMethod%60%2C%20we%20have%20added%20a%20new%20cmdlet%20to%20the%20family.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--618194410%22%20id%3D%22toc-hId--618194410%22%3EFeedback%3C%2FH2%3E%0A%3CP%3EAs%20always%2C%20we%20value%20your%20feedback%20and%20welcome%20issues%20and%20contributions%20on%20our%20GitHub%20repo%3A%20-ERR%3AREF-NOT-FOUND-%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2Fazure-powershell%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2Fazure-powershell%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EWe%E2%80%99re%20also%20conducting%20a%20survey%20until%20August%2015th%20about%20the%20PowerShell%20modules%20for%20Azure.%20Please%20take%20some%20time%20to%20provide%20your%20feedback%20on%20how%20we%E2%80%99re%20doing%2C%20it%20shapes%20our%20strategy%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fmicrosoft.qualtrics.com%2Fjfe%2Fform%2FSV_bK37YHU5FBZepcF%3FQ_CHL%3Dblog%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fmicrosoft.qualtrics.com%2Fjfe%2Fform%2FSV_bK37YHU5FBZepcF%3FQ_CHL%3Dblog%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1540306%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

`Invoke-AzRestMethod` is a new Azure PowerShell cmdlet. It allows you to make custom HTTP requests to the Azure Resource Management (ARM) endpoint using the Az context.

This cmdlet is useful when you want to manage Azure services for features that aren’t yet available in the Az PowerShell modules.

 

How to use Invoke-AzRestMethod?

As an example, you can allow access to Azure Container Registry (ACR) only for specific networks or deny public access. This feature isn’t available yet in the Az.ContainerRegistry PowerShell module. However, it can be managed in the interim with `Invoke-AzRestMethod`.

We want to disable public access to the existing ACR named `ameacr` in the `amedemo` resource group. Let’s start by understanding how the cmdlet works with a GET operation:

 

Invoke-AzRestMethod
-ResourceGroupName “amedemo”
-ResourceProviderName "Microsoft.ContainerRegistry"
-ResourceType “registries”
-Name “ameacr”
-ApiVersion 2019-12-01-preview
-Method GET

Invoke-AzRest-GET.png

To allow maximum flexibility, most of the parameters are optional. However, when you’re managing resources within a resource group, you’ll most likely need to provide either the full ID to the resource or parameters like resource group, resource provider and resource type.


The 'ResourceType' and 'Name' parameters can take multiple values when targeting resources that require more than one name. For example, to manipulate a saved search in a Log Analytics workspace, the parameters look like the following:

‘-ResourceType @('workspaces', 'savedsearches') -Name @('ame-la', 'ame-search')’


Using a mapping based on the position in the array, the cmdlet constructs the following resource Id:‘/workspaces/yabo-test-la/savedsearches/ame-search’.

 

The ‘APIVersion’ parameter allows you to use a specific API, including preview ones as it is the case here. The supported API versions for Azure Resource providers can be found in the following repository: https://github.com/Azure/azure-rest-api-specs

 

You can find the definition for the 2019-12-01-preview version of ACR at the following location: https://github.com/Azure/azure-rest-api-specs/tree/master/specification/containerregistry/resource-m...


To disable the public network access, we need to make a PATCH call to the API that changes the value of the “publicNetwokAccess” parameter:

Invoke-AzRestMethod
-ResourceGroupName amedemo
-Name "ameacr"
-ResourceProviderName "Microsoft.ContainerRegistry"
-ResourceType "registries"
-ApiVersion 2019-12-01-preview
-Payload '{ "properties": {
"publicNetworkAccess": "Disabled"
} }'
-Method PATCH

The Payload property is a JSON string that shows the path of the property to be modified.

 

Invoke-AzRest-PATCH.png

All the parameters for this API are described in the rest-api-spec file associated with this API. More specifically, the definition for the publicNetworkAccess parameter can be found in the following JSON file: https://github.com/Azure/azure-rest-api-specs/blob/2a9da9a79d0a7b74089567ec4f0289f3e0f31bec/specific...

 

To only allow access to the registry from a specific IP address, the payload needs to be adjusted as follows:

Invoke-AzRestMethod
-ResourceGroupName amedemo
-Name "ameacr"
-ResourceProviderName "Microsoft.ContainerRegistry"
-ResourceType "registries"
-ApiVersion 2019-12-01-preview
-Payload '{ "properties": {
"networkRuleSet": {
"defaultAction": "Deny",
"ipRules": [ {
"action": "Allow",
"value": "24.22.123.123"
} ]
}
} }'
-Method PATCH

 

Invoke-AzRest-PATCH-CustomIP.png

 

How does this compare to the (New|Get|Set)-AzResource?

 

The *-AzResource cmdlets allow you to customize the REST API call to Azure by specifying the resource type, the API version, and the properties to be updated. However, the properties need to be a PSObject which can easily become complicated to create.


With `Invoke-AzRestMethod`, we wanted to offer a simpler way to manage Azure resources. In the previous example, you can see that the payload is a JSON string. You don’t have to struggle with the conversion between JSON and PSObjects.


If you’re already familiar with the *-AzResource cmdlets, you can continue using them. We have no plans to stop supporting them. With `Invoke-AzRestMethod`, we have added a new cmdlet to the family.

 

Feedback

As always, we value your feedback and welcome issues and contributions on our GitHub repo: https://github.com/Azure/azure-powershell


We’re also conducting a survey until August 15th about the PowerShell modules for Azure. Please take some time to provide your feedback on how we’re doing, it shapes our strategy: 

https://microsoft.qualtrics.com/jfe/form/SV_bK37YHU5FBZepcF?Q_CHL=blog