az acr network-rule list missing virtualNetworkSubnetResourceId

[anattapol]

Describe the bug

az cli version 2.85.0, 2.86.0, 2.87.0 , it does not return virtualNetworkSubnetResourceId field under virtualNetworkRules.

Related command

az version

{
  "azure-cli": "2.86.0",
  "azure-cli-core": "2.86.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "automation": "1.0.0b1",
    "containerapp": "1.1.0b2"
  }
}

az acr network-rule list -n <acr-name> --subscription <subscription-id>

Errors

"virtualNetworkRules": [
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    }
  ]

Issue script & Debug output

> az acr network-rule list -n real_acr_name_removed --subscription real_sub_id_removed --debug
cli.knack.cli: Command arguments: ['acr', 'network-rule', 'list', '-n', 'real_acr_name_removed', '--subscription', 'real_sub_id_removed', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x108242b60>, <functionOutputProducer.on_global_arguments at 0x1084131a0>, <function CLIQuery.on_global_arguments at 0x1084494e0>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Using packaged command index for profile 'latest'.
cli.azure.cli.core: Found installed extension 'automation' (azext_automation).
cli.azure.cli.core: Blending packaged core index with local extension index.
cli.azure.cli.core: Modules found from index for 'acr': ['azure.cli.command_modules.acr']
cli.azure.cli.core: Loading command modules...
cli.azure.cli.core: Loaded command modules in parallel:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: acr                       0.052        36       149
cli.azure.cli.core: Total (1)                 0.056        36       149
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
cli.azure.cli.core: Total (0)                 0.000         0         0  
cli.azure.cli.core: Loaded 36 groups, 149 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : acr network-rule list
cli.azure.cli.core: Command table: acr network-rule list
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x108785300>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/Users/nh9vy2c/.azure/commands/2026-06-26.17-39-08.acr_network-rule_list.38057.log'.
az_command_data_logger: command args: acr network-rule list -n {} --subscription {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x10973fce0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x10973fd80>, <function register_global_policy_argument.<locals>.add_global_policy_argument at 0x10973fec0>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x10973ff60>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x10975c040>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x108413240>, <functionCLIQuery.handle_query_parameter at 0x108449580>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x10973fe20>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient
cli.azure.cli.core.auth.persistence: build_persistence: location='/Users/nh9vy2c/.azure/msal_token_cache.json', encrypt=False
cli.azure.cli.core.auth.binary_cache: load: /Users/nh9vy2c/.azure/msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.application: Broker enabled? None
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 2b74d43f-9d2f-481d-b456-ea5976127a80
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/real_sub_id_removed/resources?$filter=resourceType%20eq%20%27Microsoft.ContainerRegistry%2Fregistries%27&api-version=2024-11-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies:     'Accept': 'application/json'
cli.azure.cli.core.sdk.policies:     'x-ms-client-request-id': '2bfbf4dc-7175-11f1-8e22-22750c8b9c9e'
cli.azure.cli.core.sdk.policies:     'CommandName': 'acr network-rule list'
cli.azure.cli.core.sdk.policies:     'ParameterSetName': '-n --subscription --debug'
cli.azure.cli.core.sdk.policies:     'User-Agent': 'AZURECLI/2.86.0 (PIP) azsdk-python-core/1.39.0 Python/3.13.7 (macOS-26.5.1-arm64-arm-64bit-Mach-O)'
cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/real_sub_id_removed/resources?$filter=resourceType%20eq%20%27Microsoft.ContainerRegistry%2Fregistries%27&api-version=2024-11-01 HTTP/1.1" 200 1962
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies:     'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies:     'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies:     'Content-Length': '1962'
cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies:     'Expires': '-1'
cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-reads': '249'
cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
cli.azure.cli.core.sdk.policies:     'x-ms-request-id': '134b1797-b9d4-4be6-b642-90a5f59d41bc'
cli.azure.cli.core.sdk.policies:     'x-ms-correlation-request-id': '134b1797-b9d4-4be6-b642-90a5f59d41bc'
cli.azure.cli.core.sdk.policies:     'x-ms-routing-request-id': 'GERMANYWESTCENTRAL:20260626T153909Z:134b1797-b9d4-4be6-b642-90a5f59d41bc'
cli.azure.cli.core.sdk.policies:     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies:     'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies:     'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies:     'X-MSEdge-Ref': 'Ref A: 01C5830F442C44F78126D863F96E95C5 Ref B: FRA231050411047 Ref C: 2026-06-26T15:39:09Z'
cli.azure.cli.core.sdk.policies:     'Date': 'Fri, 26 Jun 2026 15:39:09 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"value":[{"id":"/subscriptions/real_sub_id_removed/resourceGroups/-env-gwc1-fcp-33495/providers/Microsoft.ContainerRegistry/registries/fcp33495fp74d","name":"fcp33495fp74d","type":"Microsoft.ContainerRegistry/registries","sku":{"name":"Premium","tier":"Premium"},"location":"germanywestcentral","identity":{"type":"UserAssigned","userAssignedIdentities":{"/subscriptions/real_sub_id_removed/resourcegroups/-env-gwc1-fcp-33495/providers/Microsoft.ManagedIdentity/userAssignedIdentities/-gwc1-fcp-33495":{"principalId":"378dbd92-9d39-4409-a658-af26240ea27f","clientId":"e24619bd-c9bf-4b8e-aad6-5b8248f929f8"}}},"tags":{"app.service":"notdefined","fcp-profile":"adp-2-development-hrdwn","iac.xr":"fcp-33495-fp74d","si-number":"SI12563140","snow.ciName":"adp-2-development-hrdwn-fcp-33495-fp74d","snow.serviceId":""},"systemData":{"createdBy":"f84cec6a-bc74-4974-930c-4188efed890b","createdByType":"Application","createdAt":"2026-03-24T17:04:15.2175122Z","lastModifiedBy":"f84cec6a-bc74-4974-930c-4188efed890b","lastModifiedByType":"Application","lastModifiedAt":"2026-03-24T17:04:15.2175122Z"}},{"id":"/subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed","name":"real_acr_name_removed","type":"Microsoft.ContainerRegistry/registries","sku":{"name":"Premium","tier":"Premium"},"location":"germanywestcentral","tags":{".localAccountDisabled":"true",".region":"germanywestcentral",".regionShort":"gwc1",".service":"acr",".stage":"shared","snow.ciName":"_germanywestcentral_","snow.serviceId":""},"systemData":{"createdBy":"2b53c694-11a5-4bf2-9fa1-c16be2fe61b5","createdByType":"Application","createdAt":"2026-04-23T18:04:43.7789432Z","lastModifiedBy":"2b53c694-11a5-4bf2-9fa1-c16be2fe61b5","lastModifiedByType":"Application","lastModifiedAt":"2026-04-23T18:08:47.8135521Z"}}]}
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ContainerRegistryManagementClient
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.application: Broker enabled? None
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 88f97928-c3d3-4d61-88b6-47a6498b85aa
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed?api-version=2026-01-01-preview'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies:     'Accept': 'application/json'
cli.azure.cli.core.sdk.policies:     'x-ms-client-request-id': '2bfbf4dc-7175-11f1-8e22-22750c8b9c9e'
cli.azure.cli.core.sdk.policies:     'CommandName': 'acr network-rule list'
cli.azure.cli.core.sdk.policies:     'ParameterSetName': '-n --subscription --debug'
cli.azure.cli.core.sdk.policies:     'User-Agent': 'AZURECLI/2.86.0 (PIP) azsdk-python-core/1.39.0 Python/3.13.7 (macOS-26.5.1-arm64-arm-64bit-Mach-O)'
cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed?api-version=2026-01-01-preview HTTP/1.1" 200 3783
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies:     'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies:     'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies:     'Content-Length': '3783'
cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies:     'Expires': '-1'
cli.azure.cli.core.sdk.policies:     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies:     'api-supported-versions': '2026-01-01-preview'
cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-reads': '249'
cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
cli.azure.cli.core.sdk.policies:     'x-ms-request-id': 'cff67f16-7489-4718-bdc2-3d0fea48496b'
cli.azure.cli.core.sdk.policies:     'x-ms-correlation-request-id': 'cff67f16-7489-4718-bdc2-3d0fea48496b'
cli.azure.cli.core.sdk.policies:     'x-ms-routing-request-id': 'GERMANYWESTCENTRAL:20260626T153909Z:cff67f16-7489-4718-bdc2-3d0fea48496b'
cli.azure.cli.core.sdk.policies:     'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies:     'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies:     'X-MSEdge-Ref': 'Ref A: 4FC10D891634466BAA29AE6823F8F165 Ref B: FRA231050414009 Ref C: 2026-06-26T15:39:09Z'
cli.azure.cli.core.sdk.policies:     'Date': 'Fri, 26 Jun 2026 15:39:08 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"sku":{"name":"Premium","tier":"Premium"},"type":"Microsoft.ContainerRegistry/registries","id":"/subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed","name":"real_acr_name_removed","location":"germanywestcentral","tags":{".localAccountDisabled":"true",".region":"germanywestcentral",".regionShort":"gwc1",".service":"acr",".stage":"shared","snow.ciName":"_germanywestcentral_","snow.serviceId":""},"systemData":{"createdBy":"2b53c694-11a5-4bf2-9fa1-c16be2fe61b5","createdByType":"Application","createdAt":"2026-04-23T18:04:43.7789432+00:00","lastModifiedBy":"2b53c694-11a5-4bf2-9fa1-c16be2fe61b5","lastModifiedByType":"Application","lastModifiedAt":"2026-06-12T11:56:52.2857541+00:00"},"properties":{"loginServer":"real_acr_name_removed.azurecr.io","creationDate":"2026-04-23T18:04:43.7789432Z","provisioningState":"Succeeded","adminUserEnabled":true,"networkRuleSet":{"defaultAction":"Deny","ipRules":[{"action":"Allow","value":"52.57.22.38"},{"action":"Allow","value":"103.233.174.0/27"},{"action":"Allow","value":"52.57.138.148"},{"action":"Allow","value":"18.195.120.233"},{"action":"Allow","value":"18.197.67.134"},{"action":"Allow","value":"35.157.153.217"},{"action":"Allow","value":"18.197.73.187"},{"action":"Allow","value":"194.127.21.128/29"},{"action":"Allow","value":"18.195.77.55"},{"action":"Allow","value":"18.195.134.238"},{"action":"Allow","value":"195.245.92.82"},{"action":"Allow","value":"52.57.233.215"},{"action":"Allow","value":"18.194.168.87"},{"action":"Allow","value":"35.157.220.144"},{"action":"Allow","value":"18.197.76.219"},{"action":"Allow","value":"195.245.92.81"},{"action":"Allow","value":"18.195.127.45"},{"action":"Allow","value":"194.127.26.64/26"},{"action":"Allow","value":"52.59.161.197"},{"action":"Allow","value":"18.194.215.11"},{"action":"Allow","value":"52.58.209.128"},{"action":"Allow","value":"18.195.108.169"},{"action":"Allow","value":"18.197.112.138"},{"action":"Allow","value":"18.197.165.230"},{"action":"Allow","value":"18.159.212.176"},{"action":"Allow","value":"35.158.23.119"},{"action":"Allow","value":"18.195.184.6"},{"action":"Allow","value":"18.197.70.164"},{"action":"Allow","value":"52.59.71.104"},{"action":"Allow","value":"54.93.62.252"},{"action":"Allow","value":"52.57.109.7"},{"action":"Allow","value":"18.196.246.59"},{"action":"Allow","value":"18.197.26.42"},{"action":"Allow","value":"18.197.163.120"},{"action":"Allow","value":"194.127.24.64/26"},{"action":"Allow","value":"205.167.40.128/29"},{"action":"Allow","value":"52.28.143.159"},{"action":"Allow","value":"103.233.172.0/27"},{"action":"Allow","value":"18.195.38.68"},{"action":"Allow","value":"18.197.117.66"},{"action":"Allow","value":"3.125.48.190"},{"action":"Allow","value":"52.58.131.194"}]},"policies":{"quarantinePolicy":{"status":"disabled"},"trustPolicy":{"type":"Notary","status":"disabled"},"retentionPolicy":{"days":7,"lastUpdatedTime":"2026-04-23T18:04:52.1735982+00:00","status":"disabled"},"exportPolicy":{"status":"enabled"},"azureADAuthenticationAsArmPolicy":{"status":"enabled"},"softDeletePolicy":{"retentionDays":7,"lastUpdatedTime":"2026-04-23T18:04:52.1736458+00:00","status":"disabled"}},"encryption":{"status":"disabled"},"dataEndpointEnabled":false,"regionalEndpoints":"Disabled","dataEndpointHostNames":[],"regionalEndpointHostNames":[],"endpointProtocol":"IPv4","privateEndpointConnections":[],"publicNetworkAccess":"Enabled","networkRuleBypassOptions":"AzureServices","networkRuleBypassAllowedForTasks":false,"zoneRedundancy":"Disabled","anonymousPullEnabled":false,"metadataSearch":"Disabled","roleAssignmentMode":"LegacyRegistryPermissions","autoGeneratedDomainNameLabelScope":"Unsecure"}}
cli.azure.cli.core.util: Found subscription ID real_sub_id_removed in the URL https://management.azure.com/subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed?api-version=2021-08-01-preview
cli.azure.cli.core.util: Retrieving token for resource https://management.core.windows.net/, subscription real_sub_id_removed
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.application: Broker enabled? None
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 97a17cbb-9ce4-4bda-aa8d-39d1c4f89d2f
cli.azure.cli.core.util: Request URL: 'https://management.azure.com/subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed?api-version=2021-08-01-preview'
cli.azure.cli.core.util: Request method: 'GET'
cli.azure.cli.core.util: Request headers:
cli.azure.cli.core.util:     'User-Agent': 'python/3.13.7 (macOS-26.5.1-arm64-arm-64bit-Mach-O) AZURECLI/2.86.0 (PIP)'
cli.azure.cli.core.util:     'Accept-Encoding': 'gzip, deflate'
cli.azure.cli.core.util:     'Accept': '*/*'
cli.azure.cli.core.util:     'Connection': 'keep-alive'
cli.azure.cli.core.util:     'x-ms-client-request-id': 'bd3b92bb-bb78-4be6-aa4c-1801c6f8e8d8'
cli.azure.cli.core.util:     'CommandName': 'acr network-rule list'
cli.azure.cli.core.util:     'ParameterSetName': '-n --subscription --debug'
cli.azure.cli.core.util:     'Authorization': 'Bearer eyJ0eXAiOiJKV...'
cli.azure.cli.core.util: Request body:
cli.azure.cli.core.util: None
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed?api-version=2021-08-01-preview HTTP/1.1" 200 5208
cli.azure.cli.core.util: Response status: 200
cli.azure.cli.core.util: Response headers:
cli.azure.cli.core.util:     'Cache-Control': 'no-cache'
cli.azure.cli.core.util:     'Pragma': 'no-cache'
cli.azure.cli.core.util:     'Content-Length': '5208'
cli.azure.cli.core.util:     'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.util:     'Expires': '-1'
cli.azure.cli.core.util:     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.util:     'api-supported-versions': '2021-08-01-preview'
cli.azure.cli.core.util:     'x-ms-ratelimit-remaining-subscription-reads': '249'
cli.azure.cli.core.util:     'x-ms-ratelimit-remaining-subscription-global-reads': '3748'
cli.azure.cli.core.util:     'x-ms-request-id': '5f018f90-e953-4392-b13a-67fa70f73c2e'
cli.azure.cli.core.util:     'x-ms-correlation-request-id': '5f018f90-e953-4392-b13a-67fa70f73c2e'
cli.azure.cli.core.util:     'x-ms-routing-request-id': 'GERMANYWESTCENTRAL:20260626T153910Z:5f018f90-e953-4392-b13a-67fa70f73c2e'
cli.azure.cli.core.util:     'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.util:     'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.util:     'X-MSEdge-Ref': 'Ref A: 6818B67617D34D2AB9DF4CF90555BCF7 Ref B: FRA261110501040 Ref C: 2026-06-26T15:39:09Z'
cli.azure.cli.core.util:     'Date': 'Fri, 26 Jun 2026 15:39:09 GMT'
cli.azure.cli.core.util: Response content:
cli.azure.cli.core.util: {"sku":{"name":"Premium","tier":"Premium"},"type":"Microsoft.ContainerRegistry/registries","id":"/subscriptions/real_sub_id_removed/resourceGroups/rgp-gwc1-2-sccp-dev--aks/providers/Microsoft.ContainerRegistry/registries/real_acr_name_removed","name":"real_acr_name_removed","location":"germanywestcentral","tags":{".localAccountDisabled":"true",".region":"germanywestcentral",".regionShort":"gwc1",".service":"acr",".stage":"shared","snow.ciName":"_germanywestcentral_","snow.serviceId":""},"systemData":{"createdBy":"2b53c694-11a5-4bf2-9fa1-c16be2fe61b5","createdByType":"Application","createdAt":"2026-04-23T18:04:43.7789432+00:00","lastModifiedBy":"2b53c694-11a5-4bf2-9fa1-c16be2fe61b5","lastModifiedByType":"Application","lastModifiedAt":"2026-06-12T11:56:52.2857541+00:00"},"properties":{"loginServer":"real_acr_name_removed.azurecr.io","creationDate":"2026-04-23T18:04:43.7789432Z","provisioningState":"Succeeded","adminUserEnabled":true,"networkRuleSet":{"defaultAction":"Deny","virtualNetworkRules":[{"action":"Allow","virtualNetworkSubnetResourceId":"/subscriptions/real_sub_id_removed/resourceGroups/rg-d-gwc1--dev-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1--dev/subnets/sub-d-gwc1-enterprise-44-74-23-64-27"},{"action":"Allow","virtualNetworkSubnetResourceId":"/subscriptions/real_sub_id_removed/resourceGroups/rg-d-gwc1--dev-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1--dev/subnets/sub-d-gwc1-interaction-44-74-53-160-27"},{"action":"Allow","virtualNetworkSubnetResourceId":"/subscriptions/real_sub_id_removed/resourceGroups/rg-d-gwc1--dev-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1--dev/subnets/sub-d-gwc1-management-44-74-125-224-27"},{"action":"Allow","virtualNetworkSubnetResourceId":"/subscriptions/real_sub_id_removed/resourceGroups/rg-d-gwc1-pr-test-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1-pr-test/subnets/sub-d-gwc1-enterprise-44-115-65-0-27"},{"action":"Allow","virtualNetworkSubnetResourceId":"/subscriptions/real_sub_id_removed/resourceGroups/rg-d-gwc1-pr-test-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1-pr-test/subnets/sub-d-gwc1-interaction-44-115-78-96-27"},{"action":"Allow","virtualNetworkSubnetResourceId":"/subscriptions/real_sub_id_removed/resourceGroups/rg-d-gwc1-pr-test-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1-pr-test/subnets/sub-d-gwc1-management-44-115-78-64-27"},{"action":"Allow","virtualNetworkSubnetResourceId":"/subscriptions/real_sub_id_removed/resourceGroups/rg-d-gwc1-pr-test-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1-pr-test/subnets/sub-d-gwc1-transitional-44-74-15-224-27"}],"ipRules":[{"action":"Allow","value":"52.57.22.38"},{"action":"Allow","value":"103.233.174.0/27"},{"action":"Allow","value":"52.57.138.148"},{"action":"Allow","value":"18.195.120.233"},{"action":"Allow","value":"18.197.67.134"},{"action":"Allow","value":"35.157.153.217"},{"action":"Allow","value":"18.197.73.187"},{"action":"Allow","value":"194.127.21.128/29"},{"action":"Allow","value":"18.195.77.55"},{"action":"Allow","value":"18.195.134.238"},{"action":"Allow","value":"195.245.92.82"},{"action":"Allow","value":"52.57.233.215"},{"action":"Allow","value":"18.194.168.87"},{"action":"Allow","value":"35.157.220.144"},{"action":"Allow","value":"18.197.76.219"},{"action":"Allow","value":"195.245.92.81"},{"action":"Allow","value":"18.195.127.45"},{"action":"Allow","value":"194.127.26.64/26"},{"action":"Allow","value":"52.59.161.197"},{"action":"Allow","value":"18.194.215.11"},{"action":"Allow","value":"52.58.209.128"},{"action":"Allow","value":"18.195.108.169"},{"action":"Allow","value":"18.197.112.138"},{"action":"Allow","value":"18.197.165.230"},{"action":"Allow","value":"18.159.212.176"},{"action":"Allow","value":"35.158.23.119"},{"action":"Allow","value":"18.195.184.6"},{"action":"Allow","value":"18.197.70.164"},{"action":"Allow","value":"52.59.71.104"},{"action":"Allow","value":"54.93.62.252"},{"action":"Allow","value":"52.57.109.7"},{"action":"Allow","value":"18.196.246.59"},{"action":"Allow","value":"18.197.26.42"},{"action":"Allow","value":"18.197.163.120"},{"action":"Allow","value":"194.127.24.64/26"},{"action":"Allow","value":"205.167.40.128/29"},{"action":"Allow","value":"52.28.143.159"},{"action":"Allow","value":"103.233.172.0/27"},{"action":"Allow","value":"18.195.38.68"},{"action":"Allow","value":"18.197.117.66"},{"action":"Allow","value":"3.125.48.190"},{"action":"Allow","value":"52.58.131.194"}]},"policies":{"quarantinePolicy":{"status":"disabled"},"trustPolicy":{"type":"Notary","status":"disabled"},"retentionPolicy":{"days":7,"lastUpdatedTime":"2026-04-23T18:04:52.1735982+00:00","status":"disabled"},"exportPolicy":{"status":"enabled"}},"encryption":{"status":"disabled"},"dataEndpointEnabled":false,"dataEndpointHostNames":[],"privateEndpointConnections":[],"publicNetworkAccess":"Enabled","networkRuleBypassOptions":"AzureServices","zoneRedundancy":"Disabled","anonymousPullEnabled":false}}
cli.knack.cli: Event: CommandInvoker.OnTransformResult [<function _resource_group_transform at 0x1087bafc0>, <function _x509_from_base64_to_hex_transform at 0x1087bb060>]
cli.knack.cli: Event: CommandInvoker.OnFilterResult []
{
  "ipRules": [
    {
      "action": "Allow",
      "ipAddressOrRange": "ww.xx.yy.zz"
    },
    {
      "action": "Allow",
      "ipAddressOrRange": "ww.xx.yy.zz/27"
    }
  ],
  "virtualNetworkRules": [
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null
    }
  ]
}
cli.knack.cli: Event: Cli.SuccessfulExecute []
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x108785580>]
az_command_data_logger: exit code: 0
cli.__main__: Command ran in 4.600 seconds (init: 3.396, invoke: 1.205)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4031 in cache
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/Users/nh9vy2c/.local/pipx/venvs/azure-cli/bin/python /Users/nh9vy2c/.local/pipx/venvs/azure-cli/lib/python3.13/site-packages/azure/cli/telemetry/__init__.py /Users/nh9vy2c/.azure"
telemetry.process: Return from creating process
telemetry.main: Finish creating telemetry upload process.

Expected behavior

It should return the value below when query the command.

az acr network-rule list -n <acr-name> --subscription <subscription-id>

  "virtualNetworkRules": [
    {
      "action": "Allow",
      "virtualNetworkResourceId": null,
      "virtualNetworkSubnetResourceId": "/subscriptions/xxxxxxx/resourceGroups/rg-d-gwc1-dev-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1-dev/subnets/sub-d-gwc1-enterprise-44-74-23-64-27"
    },
    {
      "action": "Allow",
      "virtualNetworkResourceId": null,
      "virtualNetworkSubnetResourceId": "/subscriptions/xxxxxxx/resourceGroups/rg-d-gwc1-dev-networking/providers/Microsoft.Network/virtualNetworks/vnet-d-gwc1-dev/subnets/sub-d-gwc1-interaction-44-74-53-160-27"
    }
]

Environment Summary

azure-cli 2.86.0 *

core 2.86.0 *
telemetry 1.1.0

Extensions:
automation 1.0.0b1
containerapp 1.1.0b2

Dependencies:
msal 1.35.1
azure-mgmt-resource 24.0.0

Python location '/Users/nh9vy2c/.local/pipx/venvs/azure-cli/bin/python'
Config directory '/Users/nh9vy2c/.azure'
Extensions directory '/Users/nh9vy2c/.azure/cliextensions'

Python (Darwin) 3.13.7 (main, Aug 14 2025, 11:12:11) [Clang 17.0.0 (clang-1700.0.13.3)]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

No response

[azure-client-tools-bot-prd]

Hi @anattapol,

2.86.0 is not the latest Azure CLI(2.87.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[azclibot]

Hi! I'm investigating this bug in az acr network-rule list.

Summary of the issue:
The command az acr network-rule list returns virtualNetworkRules entries with virtualNetworkResourceId: null instead of the expected virtualNetworkSubnetResourceId field populated with the actual subnet resource ID.

Affected versions: 2.85.0, 2.86.0, 2.87.0

Root cause direction:
The CLI output model for ACR network rules appears to be mapping the API response field virtualNetworkSubnetResourceId incorrectly — either using the wrong field name in the model/serializer, or the field was renamed at some point and the CLI model was not updated to match.

The fix should be in the acr command module, likely in the network rule list output model or the SDK client call that transforms the API response. Look at:

• src/azure-cli/azure/cli/command_modules/acr/_format.py or the network rule list command handler
• The SDK model for VirtualNetworkRule — verify the field name matches what the API returns (virtualNetworkSubnetResourceId)

Steps to reproduce:

az acr network-rule list -n <acr-name> --subscription <subscription-id>

Expected: virtualNetworkRules[*].virtualNetworkSubnetResourceId populated with the subnet resource ID
Actual: virtualNetworkRules[*].virtualNetworkResourceId: null

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Title

• Start with [ACR] — square brackets [] for a customer-facing change (added to HISTORY.rst), curly {} if not. A bug fix is customer-facing, so use [].
• Then Fix #33660: to link the issue (use the short #N form, not owner/repo#N).
• Then the affected command wrapped in backticks followed by a colon — e.g. `az vm create`:. ⚠️ The format check fails if the az ... command in the title is not inside backticks.
• Then a present-tense, capitalized verb (Fix for bug fixes; Add/Change/Deprecate/Remove otherwise) and a concise summary.
• Recommended title (note the backticks around the command):

[ACR] Fix #33660: `az <command>`: Fix <concise description of the fix>

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #33660.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [ACR] `az <command>`: <note>.
• Keep the template checklist and tick the items you've satisfied.

---

Posted by agent-assist (autonomous bug-fix pipeline).