azapi_update_resource – IP restriction default action (ipSecurityRestrictionsDefaultAction) resets back to Allow on second apply

I’m trying to configure the default IP restriction action on an Azure Function App using the azapi_update_resource resource.

Here’s the relevant Terraform code:

```
resource "azapi_update_resource" "function_app_default_action" {
type = "Microsoft.Web/sites/config@2022-09-01"
name = "web" # always "web" for the site config
parent_id = azurerm_windows_function_app.main.id

body = {
properties = {
ipSecurityRestrictionsDefaultAction = "Deny"
}
}

depends_on = [azurerm_windows_function_app.main]
}
```

**Expected Behavior**

On the first terraform apply, the property ipSecurityRestrictionsDefaultAction is correctly set to "Deny".

On subsequent runs of terraform apply, Terraform should detect no changes and leave it as "Deny"

**Actual Behavior**

On the second terraform apply, Terraform shows a planned in-place update and resets the property back to "Allow".

This causes a drift between what’s desired (Deny) and what actually ends up deployed after re-apply.

Start by reproducing the azapi_update_resource configuration against Microsoft.Web/sites/config@2022-09-01 and compare the first and second Terraform plans. Investigate how Terraform state and the Azure response represent ipSecurityRestrictionsDefaultAction. Done means repeated applies produce no update and the deployed value remains Deny.

Written by the indexing model from the issue text.