[Feature Request] az network firewall policy: add --source-geo-locations / --destination-geo-locations (GeoIP filtering, API 2026-01-01)

[kshitizmathur-max]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

Related command

az network firewall policy rule-collection-group collection add-filter-collection
(and the corresponding network-rule add/update commands

Resource Provider

Microsoft.Network/firewallPolicies/ruleCollectionGroups

Description of Feature or Work Requested

Add the following parameters to the firewall-policy network-rule commands:

• --source-geo-locations → maps to source_geo_locations
• --destination-geo-locations → maps to destination_geo_locations

API version 2026-01-01 of Microsoft.Network/firewallPolicies adds two new
properties on the network rule type to support GeoIP-based filtering:

• sourceGeoLocations (string[]) — ISO 3166-1 alpha-2 country codes
• destinationGeoLocations (string[]) — ISO 3166-1 alpha-2 country codes

These are already merged in the REST API spec
(azure-rest-api-specs PR #45631) and released in the track2 SDK
azure-mgmt-network 33.0.0. The Az CLI currently has no parameters to set
these fields, so customers cannot configure GeoIP filtering via CLI.

Minimum API Version Required

2026-01-01

Swagger PR link / SDK link

Azure/azure-rest-api-specs#45631

Request Example

See the geoIp examples in the swagger PR:https://github.com/Azure/azure-rest-api-specs/pull/45631/files

Target Date

2026-09-30

PM Contact

Suren.Jamiyanaa@microsoft.com

Engineer Contact

kshmathur@microsoft.com

Additional context

• REST API spec PR: Geo-Ip filter changes azure-rest-api-specs#45631
• API version: 2026-01-01
• SDK dependency: azure-mgmt-network >= 33.0.0
• Reference precedent: the sourceKubeSelectorGroups CLI change
• Feature: Azure Firewall Policy GeoIP filtering
• PowerShell PR #30006

[yonzhan]

Thank you for opening this issue, we will look into it.