Azure / Azure/azure-cli-extensions

az kusto cluster update with only firewall settings throws an error

Open
#9,966 1 comment 0 reactions 0 assignees View on GitHub
Auto-Assign Azure Data Explorer bug customer-reported question Service Attention
Dominant language
Python
Stars
454
Forks
1.7k
Avg merge
2d 19h
Merged PRs (30d)
64

Description

### Describe the bug

When using `az kusto cluster update --cluster-name $myCluster --resource-group $myRG --public-internet-access Enabled` on an existing cluster and database, the command fails if there is already Streaming Ingestion in place.

This seems to be because the parameter `enable_streaming_ingest` in the `update_initial` command is defaulting to *False*.

This prevents updating the firewall status.

There seems to be a number of properties that are not preserved unless they are explicitly included in the parameters. As well as `enable_srteaming_ingest` there is also `enable_purge` and `enable_double_encryption`. Instead of being set to False these should default to None to retain existing settings OR the code should identify that these have not be included and identify them as required parameters.

### Related command

az kusto cluster update

### Errors

ERROR: (InvalidClusterUpdateProperty) [BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy.

### Issue script & Debug output

cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '61b664ea-6df3-11f1-8fea-00249b8490f5'
cli.azure.cli.core.sdk.policies: 'CommandName': 'kusto cluster update'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--cluster-name --resource-group --public-network-access --allowed-ip-range-list --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.82.0 (MSI) azsdk-python-core/1.37.0 Python/3.13.9 (Windows-11-10.0.26200-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/subid/providers/Microsoft.Kusto/locations/Australia%20East/operationResults/guid?api-version=2022-02-01 HTTP/1.1" 200 681
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '681'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-operation-root-activity-id': '95ed9ab3-2181-4e10-aad7-e3edd7052eed'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-resource-requests': '1099'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies: 'Date': 'Mon, 22 Jun 2026 04:33:04 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"id":"/subscriptions/subid/providers/Microsoft.Kusto/locations/Australia East/operationresults/guid","name":"guid","status":"Failed","startTime":"2026-06-22T04:32:34.4003118Z","endTime":"2026-06-22T04:32:35.8545071Z","percentComplete":1.0,"properties":{"operationKind":"ServiceConfigurationAlter","provisioningState":"Failed","operationState":"BadInput"},"error":{"code":"InvalidClusterUpdateProperty","message":"[BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy."}}
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/base_polling.py", line 805, in run
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/base_polling.py", line 837, in _poll
azure.core.polling.base_polling.OperationFailed: Operation failed or canceled

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 669, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 737, in _run_jobs_serially
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 717, in _run_job
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 1088, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 1075, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/_poller.py", line 326, in result
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/tracing/decorator.py", line 119, in wrapper_use_tracer
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/_poller.py", line 345, in wait
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/_poller.py", line 250, in _start
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/base_polling.py", line 820, in run
azure.core.exceptions.HttpResponseError: (InvalidClusterUpdateProperty) [BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy.
Code: InvalidClusterUpdateProperty
Message: [BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy.

cli.azure.cli.core.azclierror: (InvalidClusterUpdateProperty) [BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy.
Code: InvalidClusterUpdateProperty
Message: [BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy.
az_command_data_logger: (InvalidClusterUpdateProperty) [BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy.
Code: InvalidClusterUpdateProperty
Message: [BadRequest] Property 'EnableStreamingIngest' is invalid, Error Message: Unable to disable streaming ingestion since there is an active table streaming ingestion policy.
cli.knack.cli: Event: Cli.PostExecute []
az_command_data_logger: exit code: 1
cli.__main__: Command ran in 35.568 seconds (init: 1.306, invoke: 34.262)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 5100 in cache file under C:\Users\me\.azure\telemetry\20260622143305389
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry\__init__.pyc C:\Users\me\.azure C:\Users\me\.azure\telemetry\20260622143305389"
telemetry.process: Return from creating process 37356
telemetry.main: Finish creating telemetry upload process.

### Expected behavior

Azure Data Explorer cluster has its network firewall set to "allowed from all IP Addresses"

### Environment Summary

azure-cli 2.82.0 *

core 2.82.0 *
telemetry 1.1.0

Extensions:
kusto 0.5.0
scheduled-query 1.0.0b2

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\me\.azure'
Extensions directory 'C:\Users\me\.azure\cliextensions'

Python (Windows) 3.13.9 (tags/v3.13.9:8183fa5, Oct 14 2025, 14:09:13) [MSC v.1944 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

### Additional context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the `az kusto cluster update` entry point and trace the `update_initial` parameters, especially `enable_streaming_ingest`, `enable_purge`, and `enable_double_encryption`. Reproduce the command against a cluster with Streaming Ingestion enabled; done means firewall settings update without resetting omitted cluster properties or triggering the reported error.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, python
Domain
cli, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.