[SQL] `az sql db/server audit-policy update`: Add `--required-fields' parameter and upgrade azure-mgmt-sql to 5.0.0b2 by janardhanrh · Pull Request #34213 · Azure/azure-cli

janardhanrh · 2026-10-12T10:14:08Z

Upgrade azure-mgmt-sql from 4.0.0b22 to 5.0.0b2. This release targets API version 2026-08-01-preview by default and natively defines requiredFields on the server and database blob auditing policies, so the new --required-fields argument is passed through the SDK models without any direct REST calls.

New argument:

Add --required-fields to sql db audit-policy update and sql server audit-policy update. It is only accepted when auditing and the Azure Monitor target are enabled, and cannot be combined with --state Disabled.
Add help examples and unit tests (test_sql_audit_policy.py).

Changes required by the SDK upgrade:

Bump the pin in pyproject.toml and requirements.py3.{Linux,Darwin,windows}.txt.
commands.py: the SDK renamed DatabaseEncryptionProtectorOperations to DatabaseEncryptionProtectorsOperations; update the operations template.
_validators.py: 5.0.0b2 models are generated from TypeSpec (azure.mgmt.sql._utils.model_base.Model) and no longer define the msrest _validation map, which create_args_for_complex_type read directly. This raised AttributeError while registering arguments for most sql commands (for example sql db create). Read it with getattr(..., {}) instead. Note that arguments derived from complex models are no longer marked required through that map.
custom.py: the new SDK serializes request bodies with json.dumps, which cannot serialize the plain Enum member used as the default minimal TLS version in server create. Pass its .value instead.

Known follow-up: existing scenario test recordings were captured with API version 2024-11-01-preview and must be re-recorded against 2026-08-01-preview.

Related command
az sql db audit-policy update
az sql server audit-policy update
az sql db audit-policy show
az sql server audit-policy show

Description
Upgrade azure-mgmt-sql from 4.0.0b22 to 5.0.0b2. This release targets API version 2026-08-01-preview by default and natively defines requiredFields on the server and database blob auditing policies, so the new --required-fields argument is passed through the SDK models without any direct REST calls.

New argument:

Add --required-fields to sql db audit-policy update and sql server audit-policy update. It is only accepted when auditing and the Azure Monitor target are enabled, and cannot be combined with --state Disabled.
Add help examples and unit tests (test_sql_audit_policy.py).

Changes required by the SDK upgrade:

Bump the pin in pyproject.toml and requirements.py3.{Linux,Darwin,windows}.txt.
commands.py: the SDK renamed DatabaseEncryptionProtectorOperations to DatabaseEncryptionProtectorsOperations; update the operations template.
_validators.py: 5.0.0b2 models are generated from TypeSpec (azure.mgmt.sql._utils.model_base.Model) and no longer define the msrest _validation map, which create_args_for_complex_type read directly. This raised AttributeError while registering arguments for most sql commands (for example sql db create). Read it with getattr(..., {}) instead. Note that arguments derived from complex models are no longer marked required through that map.
custom.py: the new SDK serializes request bodies with json.dumps, which cannot serialize the plain Enum member used as the default minimal TLS version in server create. Pass its .value instead.

Testing Guide

Manual Testing steps:

Command to update server-level auditing policy to use the require-fields.
az sql server audit-policy update --name jrh-final-validation -g jhungund_rg_new --state Enabled --actions BATCH_COMPLETED_GROUP --lats Enabled --lawri "/subscriptions/857355f0-57d5-4754-b91a-0393dbff9afc/resourceGroups/jhungund_rg_new/providers/Microsoft.OperationalInsights/workspaces/jhungund-la" --required-fields statement action_id action_name database_name
{
"auditActionsAndGroups": [
"BATCH_COMPLETED_GROUP"
],
"id": "/subscriptions/857355f0-57d5-4754-b91a-0393dbff9afc/resourceGroups/jhungund_rg_new/providers/Microsoft.Sql/servers/jrh-final-validation/auditingSettings/Default",
"isAzureMonitorTargetEnabled": true,
"isDevopsAuditEnabled": null,
"isManagedIdentityInUse": false,
"isStorageSecondaryKeyInUse": null,
"name": "Default",
"queueDelayMs": null,
"requiredFields": [
"statement",
"action_id",
"action_name",
"database_name"
],
"resourceGroup": "jhungund_rg_new",
"retentionDays": 0,
"state": "Enabled",
"storageAccountAccessKey": null,
"storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
"storageEndpoint": "",
"systemData": null,
"type": "Microsoft.Sql/servers/auditingSettings"
}
Verify that the show command also shows the required fields for the server
(env) Q:\src\azure-cli>az sql server audit-policy show --name jrh-final-validation -g jhungund_rg_new
{
"auditActionsAndGroups": [
"BATCH_COMPLETED_GROUP"
],
"id": "/subscriptions/857355f0-57d5-4754-b91a-0393dbff9afc/resourceGroups/jhungund_rg_new/providers/Microsoft.Sql/servers/jrh-final-validation/auditingSettings/Default",
"isAzureMonitorTargetEnabled": true,
"isDevopsAuditEnabled": null,
"isManagedIdentityInUse": false,
"isStorageSecondaryKeyInUse": null,
"name": "Default",
"queueDelayMs": null,
"requiredFields": [
"statement",
"action_id",
"action_name",
"database_name"
],
"resourceGroup": "jhungund_rg_new",
"retentionDays": 0,
"state": "Enabled",
"storageAccountAccessKey": null,
"storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
"storageEndpoint": "",
"systemData": null,
"type": "Microsoft.Sql/servers/auditingSettings"
}
Command to enable database-level auditing with required-fields.
(env) Q:\src\azure-cli>az sql db audit-policy update --name jrhDB --server jrh-final-validation -g jhungund_rg_new --state Enabled --actions BATCH_COMPLETED_GROUP --lats Enabled --lawri "/subscriptions/857355f0-57d5-4754-b91a-0393dbff9afc/resourceGroups/jhungund_rg_new/providers/Microsoft.OperationalInsights/workspaces/jhungund-la" --required-fields statement action_id action_name database_name
{
"auditActionsAndGroups": [
"BATCH_COMPLETED_GROUP"
],
"id": "/subscriptions/857355f0-57d5-4754-b91a-0393dbff9afc/resourceGroups/jhungund_rg_new/providers/Microsoft.Sql/servers/jrh-final-validation/databases/jrhDB/auditingSettings/Default",
"isAzureMonitorTargetEnabled": true,
"isManagedIdentityInUse": false,
"isStorageSecondaryKeyInUse": false,
"kind": null,
"name": "Default",
"queueDelayMs": null,
"requiredFields": [
"statement",
"action_id",
"action_name",
"database_name"
],
"resourceGroup": "jhungund_rg_new",
"retentionDays": 0,
"state": "Enabled",
"storageAccountAccessKey": null,
"storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
"storageEndpoint": null,
"systemData": null,
"type": "Microsoft.Sql/servers/databases/auditingSettings"
}
Verify that the database-level show command shows the required fields
(env) Q:\src\azure-cli>az sql db audit-policy show --name jrhDB --server jrh-final-validation -g jhungund_rg_new
{
"auditActionsAndGroups": [
"BATCH_COMPLETED_GROUP"
],
"id": "/subscriptions/857355f0-57d5-4754-b91a-0393dbff9afc/resourceGroups/jhungund_rg_new/providers/Microsoft.Sql/servers/jrh-final-validation/databases/jrhDB/auditingSettings/Default",
"isAzureMonitorTargetEnabled": true,
"isManagedIdentityInUse": false,
"isStorageSecondaryKeyInUse": null,
"kind": null,
"name": "Default",
"queueDelayMs": null,
"requiredFields": [
"statement",
"action_id",
"action_name",
"database_name"
],
"resourceGroup": "jhungund_rg_new",
"retentionDays": 0,
"state": "Enabled",
"storageAccountAccessKey": null,
"storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
"storageEndpoint": "",
"systemData": null,
"type": "Microsoft.Sql/servers/databases/auditingSettings"
}

Unit test execution:
ython -m pytest src\azure-cli\azure\cli\command_modules\sql\tests\latest\test_sql_audit_policy.py -v
=========================================================================================================== test session starts ============================================================================================================
platform win32 -- Python 3.14.7, pytest-9.1.1, pluggy-1.6.0 -- Q:\src\azure-cli\env\Scripts\python.exe
cachedir: .pytest_cache
rootdir: Q:\src\azure-cli\src\azure-cli
configfile: pyproject.toml
plugins: forked-1.7.5, xdist-3.8.0
collected 6 items

src\azure-cli\azure\cli\command_modules\sql\tests\latest\test_sql_audit_policy.py::SqlAuditPolicyRequiredFieldsTest::test_no_arguments_still_fails_argument_validation PASSED [ 16%]
src\azure-cli\azure\cli\command_modules\sql\tests\latest\test_sql_audit_policy.py::SqlAuditPolicyRequiredFieldsTest::test_required_fields_alone_satisfies_argument_validation PASSED [ 33%]
src\azure-cli\azure\cli\command_modules\sql\tests\latest\test_sql_audit_policy.py::SqlAuditPolicyRequiredFieldsTest::test_required_fields_applied_when_azure_monitor_enabled PASSED [ 50%]
src\azure-cli\azure\cli\command_modules\sql\tests\latest\test_sql_audit_policy.py::SqlAuditPolicyRequiredFieldsTest::test_required_fields_rejected_when_state_disabled PASSED [ 66%]
src\azure-cli\azure\cli\command_modules\sql\tests\latest\test_sql_audit_policy.py::SqlAuditPolicyRequiredFieldsTest::test_required_fields_rejected_without_azure_monitor PASSED [ 83%]
src\azure-cli\azure\cli\command_modules\sql\tests\latest\test_sql_audit_policy.py::SqlAuditPolicyRequiredFieldsTest::test_show_returns_required_fields_from_sdk PASSED [100%]

============================================================================================================= warnings summary =============================================================================================================
env\Lib\site-packages\dateutil\tz\tz.py:37
Q:\src\azure-cli\env\Lib\site-packages\dateutil\tz\tz.py:37: DeprecationWarning: datetime.datetime.utcfromtimestamp() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.fromtimestamp(timestamp, datetime.UTC).
EPOCH = datetime.datetime.utcfromtimestamp(0)

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
======================================================================================================= 6 passed, 1 warning in 0.36s =======================================================================================================
History Notes

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

… parameter and upgrade azure-mgmt-sql to 5.0.0b2 Upgrade azure-mgmt-sql from 4.0.0b22 to 5.0.0b2. This release targets API version 2026-08-01-preview by default and natively defines `requiredFields` on the server and database blob auditing policies, so the new `--required-fields` argument is passed through the SDK models without any direct REST calls. New argument: - Add `--required-fields` to `sql db audit-policy update` and `sql server audit-policy update`. It is only accepted when auditing and the Azure Monitor target are enabled, and cannot be combined with `--state Disabled`. - Add help examples and unit tests (test_sql_audit_policy.py). Changes required by the SDK upgrade: - Bump the pin in pyproject.toml and requirements.py3.{Linux,Darwin,windows}.txt. - commands.py: the SDK renamed DatabaseEncryptionProtectorOperations to DatabaseEncryptionProtectorsOperations; update the operations template. - _validators.py: 5.0.0b2 models are generated from TypeSpec (azure.mgmt.sql._utils.model_base.Model) and no longer define the msrest `_validation` map, which create_args_for_complex_type read directly. This raised AttributeError while registering arguments for most sql commands (for example `sql db create`). Read it with getattr(..., {}) instead. Note that arguments derived from complex models are no longer marked required through that map. - custom.py: the new SDK serializes request bodies with json.dumps, which cannot serialize the plain Enum member used as the default minimal TLS version in server create. Pass its `.value` instead. Known follow-up: existing scenario test recordings were captured with API version 2024-11-01-preview and must be re-recorded against 2026-08-01-preview. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-10-12T10:14:18Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

microsoft-github-policy-service · 2026-10-12T10:14:32Z

Thank you for your contribution janardhanrh! We will review the pull request and get back to you soon.

Copilot

🟡 Changes recommended

Required-argument validation regresses, disabling Azure Monitor can produce an invalid policy, and existing scenario recordings will no longer match.

5 open findings

What changed in this PR

Adds SQL audit --required-fields support and upgrades azure-mgmt-sql for the new API model.

Changes:

Adds audit-policy parameter handling, validation, help, and tests.
Updates SDK compatibility code and operation names.
Synchronizes dependency pins across platforms.

File	Description
`requirements.py3.windows.txt`	Updates Windows SDK pin.
`requirements.py3.Linux.txt`	Updates Linux SDK pin.
`requirements.py3.Darwin.txt`	Updates macOS SDK pin.
`pyproject.toml`	Updates primary SQL SDK dependency.
`test_sql_audit_policy.py`	Tests required-fields behavior.
`custom.py`	Implements validation and model updates.
`commands.py`	Updates renamed SDK operation class.
`_validators.py`	Handles missing legacy validation metadata.
`_params.py`	Registers the new argument.
`_help.py`	Adds usage examples.

🧠 Review effort: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+        validation = getattr(model_type, '_validation', {}).get(name, None)  # pylint: disable=protected-access
        required = validation.get('required', False) if validation else False


    'azure-mgmt-signalr==2.0.0b2',
    'azure-mgmt-sqlvirtualmachine==1.0.0b5',
-    'azure-mgmt-sql==4.0.0b22',
+    'azure-mgmt-sql==5.0.0b2',


+    if required_fields is not None:
+        if not _is_audit_policy_state_enabled(instance.state) or not instance.is_azure_monitor_target_enabled:
+            raise ValidationError(
+                'required-fields can only be specified when auditing and the Azure Monitor target are enabled')
+        instance.required_fields = required_fields


+                   help='List of fields to include in audit events. Can only be specified when the Azure Monitor '
+                        'target is enabled.',


    if not state and not blob_storage_arguments_provided and\
-            not log_analytics_arguments_provided and not event_hub_arguments_provided:
+            not log_analytics_arguments_provided and not event_hub_arguments_provided and required_fields is None:
        raise CLIError('Either state or blob storage or log analytics or event hub arguments are missing')


Aditya Pujara (a0x1ab) · 2026-10-12T10:34:22Z

/azp run

azure-pipelines · 2026-10-12T10:34:41Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Yong Zhang (yonzhan) · 2026-10-12T20:52:09Z

Please fix CI issues

Copilot AI balanced review requested due to automatic review settings October 12, 2026 10:14

janardhanrh requested review from a team as code owners October 12, 2026 10:14

microsoft-github-policy-service Bot requested a review from Yong Zhang (yonzhan) October 12, 2026 10:14

microsoft-github-policy-service Bot added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Oct 12, 2026

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot SQL az sql act-codegen-extensibility-squad labels Oct 12, 2026

Copilot started reviewing on behalf of janardhanrh October 12, 2026 10:15 View session

Copilot AI reviewed Oct 12, 2026

View reviewed changes

Yong Zhang (yonzhan) requested a review from NoriZC October 12, 2026 20:51

Yong Zhang (yonzhan) assigned NoriZC Oct 12, 2026

Yong Zhang (yonzhan) added this to the Backlog milestone Oct 12, 2026

Navigation Menu

Repository navigation

[SQL] `az sql db/server audit-policy update`: Add `--required-fields' parameter and upgrade azure-mgmt-sql to 5.0.0b2 - #34213

[SQL] `az sql db/server audit-policy update`: Add `--required-fields' parameter and upgrade azure-mgmt-sql to 5.0.0b2#34213
janardhanrh wants to merge 1 commit into
Azure:devfrom
janardhanrh:selective_fields_support_with_sdk

janardhanrh commented Oct 12, 2026

Uh oh!

azure-pipelines Bot commented Oct 12, 2026

Uh oh!

microsoft-github-policy-service Bot commented Oct 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 12, 2026

Uh oh!

azure-pipelines Bot commented Oct 12, 2026

Uh oh!

Yong Zhang (yonzhan) commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		validation = getattr(model_type, '_validation', {}).get(name, None) # pylint: disable=protected-access
		required = validation.get('required', False) if validation else False

		help='List of fields to include in audit events. Can only be specified when the Azure Monitor '
		'target is enabled.',

Conversation

janardhanrh commented Oct 12, 2026

Uh oh!

azure-pipelines Bot commented Oct 12, 2026

Uh oh!

microsoft-github-policy-service Bot commented Oct 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 12, 2026

Uh oh!

azure-pipelines Bot commented Oct 12, 2026

Uh oh!

Yong Zhang (yonzhan) commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants