Added support to pass multiple UAMI to Azure Firewall Policy

[Balashivaram]

Description

   	As part of explicit proxy V2, we will be migrating from PAC File SAS URL to PAC File URL and we will be moving from two two port to single Port, which means both HTTP and HTTPs will be served in single Port. To support PAC File URL , cx needs to input an identity which has Storage Blob Data Contributor and Storage Blob Data reader role to the respective storage account. Customer can either configure a separate Managed Identity for Explicit Proxy or else they can use same identity which is being used in TLS Inspection with the above roles added to it. If they wish to configure separate identity for Explicit Proxy they need to create MSI with this prefix PacFileMSI-. To support the above changes, In CLI and PowerShell we will be updating the existing Parameter Identity type from string to list of strings. PowerShell do support value as string even though the parameter type is list of strings

Mandatory Checklist

• Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)

  • General release
  • Public preview
  • Private preview
  • Engineering build
  • No need for a release

• Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT adjust version of module manually in pull request

[azure-client-tools-bot-prd]

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

[Balashivaram]

@Balashivaram please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

[Balashivaram]

@microsoft-github-policy-service agree company="Microsoft"

[github-actions]

To the author of the pull request,
This PR was labeled "Contains Breaking Change" because breaking changes have been detected by the static analysis pipeline.

• According to our policy, breaking changes can only take place during major release and they must be preannounced.
• Please follow our guide on the detailed steps.
• Required: Please fill in the task below to facilitate our contact,you will receive notifications related to breaking changes.

[cshahra]

LGTM.
Consider adding test cases where -UserAssignedIdentityId and -UserAssignedIdentityIds are provided together.
Update the docs for New/Set Command

[bewatersmsft]

+1 again to @cshahra , LGTM

[VeryEarly]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[VeryEarly]

https://github.com/Azure/azure-powershell/blob/main/documentation/development-docs/design-guidelines/parameter-best-practices.md#singularity

Remove the new parameter and make existing UserAssignedIdentityId type from string to string[], this will not be considered as breaking change.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR extends Azure Firewall Policy cmdlets to support assigning multiple user-assigned managed identities (UAMIs) (enabling scenarios like explicit proxy PAC file access + TLS inspection), and updates related help/test assets.

Changes:

• Updated New-AzFirewallPolicy / Set-AzFirewallPolicy to accept multiple values for -UserAssignedIdentityId and map them into Identity.UserAssignedIdentities.
• Updated markdown help to reflect the parameter type change and added -ProgressAction documentation blocks.
• Updated/added scenario tests and recordings around explicit proxy + identity assignment.

Reviewed changes

Copilot reviewed 8 out of 10 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
src/Network/Network/help/Set-AzFirewallPolicy.md	Updates syntax/type docs for -UserAssignedIdentityId and adds -ProgressAction section.
src/Network/Network/help/New-AzFirewallPolicy.md	Updates syntax/type docs for -UserAssignedIdentityId and adds -ProgressAction section.
src/Network/Network/ChangeLog.md	Notes the UserAssignedIdentityId type change.
src/Network/Network/AzureFirewallPolicy/SetAzureFirewallPolicyCommand.cs	Implements multi-UAMI mapping for set/update paths.
src/Network/Network/AzureFirewallPolicy/NewAzureFirewallPolicyCommand.cs	Implements multi-UAMI mapping on create path.
src/Network/Network/AzureFirewallPolicy/ExplicitProxy/NewAzureFirewallPolicyExplicitProxyCommand.cs	Updates PAC file help message from SAS URL to URL.
src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.ps1	Updates explicit proxy CRUD test and adds a multi-UAMI scenario test.
src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.cs	Wires up the new multi-UAMI scenario test.
src/Network/Network.Test/SessionRecords/.../TestAzureFirewallPolicyExplicitProxyCRUD.json	Updates recordings for explicit proxy CRUD.

[VeryEarly]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[VeryEarly]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[cshahra]

LGTM for most of the practical scenarios unless someone is using a script like this in their pipeline:

[Copilot]

Pull request overview

Copilot reviewed 9 out of 11 changed files in this pull request and generated 3 comments.

[VeryEarly]

/azp run

wait for pr validation

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 9 out of 11 changed files in this pull request and generated 2 comments.

[VeryEarly]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).