{Network} az network ddos-custom-policy: Support DDoS mitigation rules with API version 2026-03-01

src/azure-cli/azure/cli/command_modules/network/_help.py

@@ -6258,4 +6258,8 @@
         az network ddos-custom-policy create --resource-group rg1 --ddos-custom-policy-name test-ddos-custom-policy \\
             --location centraluseuap --detection-rule-name detectionRuleTcp \\
             --detection-mode TrafficThreshold --traffic-type Tcp --packets-per-second 1000000
+  - name: Create DDoS custom policy with a TCP mitigation rule that denies traffic from a prefix or country
+    text: |
+        az network ddos-custom-policy create --resource-group rg1 --ddos-custom-policy-name test-ddos-custom-policy \\
+            --location centraluseuap --mitigation-rules "[{name:mitigationRuleTcp,traffic-scope:Tcp,tcp-default-mitigations:{per-source-rate-limiting:{packets-per-second:100000},per-source-connection-rate-limiting:{connections-per-second:1000}},source-policy-overrides:[{policy-action:{action-type:Deny},conditions:{ip-prefixes:[198.51.100.0/24],geo-matches:[{country-code:CA}]}}]}]"
 """

src/azure-cli/azure/cli/command_modules/network/_params.py

@@ -856,4 +856,9 @@ def load_arguments(self, _):
         c.argument('detection_mode', arg_group='Detection Rules', help='The detection mode for the DDoS detection rule.')
         c.argument('traffic_type', arg_group='Detection Rules', help='The traffic type (one of Tcp, Udp, TcpSyn) that the detection rule will be applied upon.')
         c.argument('packets_per_second', arg_group='Detection Rules', help='The customized packets per second threshold.')
+        from .aaz.latest.network.ddos_custom_policy import Create as _DdosCustomPolicyCreate
+        # reuse the generated AAZ arg so shorthand/JSON parsing, `??` help and validation stay in sync with the API
+        mitigation_rules = _DdosCustomPolicyCreate._build_arguments_schema().mitigation_rules.to_cmd_arg('mitigation_rules').type.settings  # pylint: disable=protected-access
+        c.argument('mitigation_rules', options_list=['--mitigation-rules'], arg_group='Mitigation Rules',
+                   action=mitigation_rules['action'], nargs=mitigation_rules['nargs'], help=mitigation_rules['help'])
     # endregion

src/azure-cli/azure/cli/command_modules/network/_template_builder.py

@@ -520,7 +520,7 @@ def build_vpn_connection_resource(cmd, name, location, tags, gateway1, gateway2,
 
 
 def build_ddos_custom_policy(cmd, ddos_custom_policy_name, location=None, tags=None, detection_rule_name=None,
-                             detection_mode=None, packets_per_second=None, traffic_type=None):
+                             detection_mode=None, packets_per_second=None, traffic_type=None, mitigation_rules=None):
     policy = {'ddos_custom_policy_name': ddos_custom_policy_name}
 
     if location:
@@ -529,6 +529,12 @@ def build_ddos_custom_policy(cmd, ddos_custom_policy_name, location=None, tags=N
     if tags:
         policy['tags'] = tags
 
+    if mitigation_rules:
+        policy['mitigation_rules'] = mitigation_rules
+
+    if not (detection_rule_name or detection_mode or packets_per_second or traffic_type):
+        return policy
+
     detection_rules = {}
     traffic_detection_rule = {}
 

src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/ddos_custom_policy/_delete.py

@@ -23,9 +23,9 @@ class Delete(AAZCommand):
     """
 
     _aaz_info = {
-        "version": "2025-07-01",
+        "version": "2026-03-01",
         "resources": [
-            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.network/ddoscustompolicies/{}", "2025-07-01"],
+            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.network/ddoscustompolicies/{}", "2026-03-01"],
         ]
     }
 
@@ -143,7 +143,7 @@ def url_parameters(self):
         def query_parameters(self):
             parameters = {
                 **self.serialize_query_param(
-                    "api-version", "2025-07-01",
+                    "api-version", "2026-03-01",
                     required=True,
                 ),
             }