[Cognitive Services] Add: az cognitiveservices account managed-network and outbound-rule commands

[M-Hietala]

Related command
az cognitiveservices account managed-network
az cognitiveservices account managed-network outbound-rule

Description
Add managed network and outbound rule CLI commands for Azure Cognitive Services (AI Foundry) accounts. These commands enable users to configure network isolation and control egress traffic from managed networks.

Testing Guide

New commands (all marked is_preview=True):

Managed Network:

az cognitiveservices account managed-network create — Create a managed network with isolation mode (allow_internet_outbound / allow_only_approved_outbound) and optional firewall SKU
az cognitiveservices account managed-network update — Update managed network settings
az cognitiveservices account managed-network show — Show managed network settings
az cognitiveservices account managed-network provision-network — Provision the managed network
Outbound Rules:

az cognitiveservices account managed-network outbound-rule list — List outbound rules
az cognitiveservices account managed-network outbound-rule show — Show a specific outbound rule
az cognitiveservices account managed-network outbound-rule remove — Delete an outbound rule
az cognitiveservices account managed-network outbound-rule set — Create/update an outbound rule (FQDN, PrivateEndpoint, or ServiceTag)
az cognitiveservices account managed-network outbound-rule bulk-set — Bulk create/update outbound rules from a YAML or JSON file
SDK dependency: Requires azure-mgmt-cognitiveservices~=15.0.0b1 (API version 2026-01-15-preview). The SDK PR is Azure/azure-sdk-for-python#45942. setup.py has been updated but CI will fail until the SDK is published to PyPI.

Testing Guide

Create a managed network with internet outbound access

az cognitiveservices account managed-network create
-g myResourceGroup -n myAccount
--managed-network allow_internet_outbound

Create with approved outbound only and standard firewall

az cognitiveservices account managed-network create
-g myResourceGroup -n myAccount
--managed-network allow_only_approved_outbound
--firewall-sku Standard

Show managed network settings

az cognitiveservices account managed-network show
-g myResourceGroup -n myAccount

Provision the managed network

az cognitiveservices account managed-network provision-network
-g myResourceGroup -n myAccount

Create an FQDN outbound rule

az cognitiveservices account managed-network outbound-rule set
-g myResourceGroup -n myAccount
--rule my-fqdn-rule --type fqdn
--destination "*.openai.azure.com"

Create a ServiceTag outbound rule

az cognitiveservices account managed-network outbound-rule set
-g myResourceGroup -n myAccount
--rule my-servicetag-rule --type servicetag
--destination '{"serviceTag":"Storage","protocol":"TCP","portRanges":"443"}'

List outbound rules

az cognitiveservices account managed-network outbound-rule list
-g myResourceGroup -n myAccount

Bulk set rules from a YAML file

az cognitiveservices account managed-network outbound-rule bulk-set
-g myResourceGroup -n myAccount
--file rules.yaml

Remove an outbound rule

az cognitiveservices account managed-network outbound-rule remove
-g myResourceGroup -n myAccount
--rule my-fqdn-rule

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-client-tools-bot-prd]

Validation for Azure CLI Full Test Starting...

Thanks for your contribution!

[azure-client-tools-bot-prd]

Validation for Breaking Change Starting...

Thanks for your contribution!

[yonzhan]

Thank you for your contribution! We will review the pull request and get back to you soon.

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>