Creating subnet with --address-prefixes and getting it with addressPrefix instead

[smereczynski]

Describe the bug

When creating subnet with --address-prefixes parameter and one prefix, CLI is creating subnet properly but it has "addressPrefix" string parameter, not "addressPrefixes" string[]. This situation causes lack of possibility to create (using CLI) subnet that will be possible to allocate in Network Manager IPAM IP address pool

Related command

az network vnet subnet create --resource-group <RG_NAME> --vnet-name <VNET_NAME> --name default --address-prefixes 10.11.0.0/24

Errors

Error: Invalid configuration on subnet /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/default; cannot populate both address prefix and address prefixes.

Issue script & Debug output

cli.knack.cli: Command arguments: ['network', 'vnet', 'subnet', 'create', '--resource-group', '<RG_NAME>', '--vnet-name', '<VNET_NAME>', '--name', '<SUBNET_NAME>', '--address-prefixes', '<CIDR_BLOCK>', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x********>, <function OutputProducer.on_global_arguments at 0x********>, <function CLIQuery.on_global_arguments at 0x********>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'network': ['azure.cli.command_modules.network', 'azure.cli.command_modules.privatedns', 'azext_firewall']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: network 5.953 120 377
cli.azure.cli.core: privatedns 0.143 14 60
cli.azure.cli.core: Total (2) 6.096 134 437
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: azure-firewall 0.302 21 60 /.azure/cliextensions/azure-firewall
cli.azure.cli.core: Total (1) 0.302 21 60
cli.azure.cli.core: Loaded 153 groups, 497 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : network vnet subnet create
cli.azure.cli.core: Command table: network vnet subnet create
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x********>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/.azure/commands/2025-08-26.13-50-45.network_vnet_subnet_create..log'.
az_command_data_logger: command args: network vnet subnet create --resource-group {} --vnet-name {} --name {} --address-prefixes {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x********>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x********>, <function register_cache_arguments..add_cache_arguments at 0x********>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x********>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x********>, <function CLIQuery.handle_query_parameter at 0x********>, <function register_ids_argument..parse_ids_arguments at 0x********>]
cli.azure.cli.core.auth.persistence: build_persistence: location='/.azure/msal_token_cache.json', encrypt=False
cli.azure.cli.core.auth.binary_cache: load: /.azure/msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/<TENANT_ID>
msal.authority: openid_config("https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration") = { ... 'issuer': 'https://login.microsoftonline.com/<TENANT_ID>/v2.0', ... }
msal.application: Broker enabled? None
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Found 1 RTs matching {'environment': 'login.microsoftonline.com', 'home_account_id': '.<TENANT_ID>', 'family_id': '1'}
msal.telemetry: Generate or reuse correlation_id:
msal.application: Cache attempts an RT
urllib3.connectionpool: Starting new HTTPS connection (1): login.microsoftonline.com:443
urllib3.connectionpool: https://login.microsoftonline.com:443 "POST /<TENANT_ID>/oauth2/v2.0/token HTTP/1.1" 200 6268
msal.token_cache: event={
"client_id": "<PUBLIC_CLIENT_ID>",
"data": {
"claims": "{...}",
"refresh_token": "",
"scope": ["profile","https://management.core.windows.net//.default","openid","offline_access"]
},
"environment": "login.microsoftonline.com",
"grant_type": "refresh_token",
"response": {
"access_token": "",
"client_info": "",
"expires_in": 4879,
"ext_expires_in": 4879,
"foci": "1",
"id_token": "",
"scope": "https://management.core.windows.net//user_impersonation https://management.core.windows.net//.default",
"token_type": "Bearer"
},
"scope": ["https://management.core.windows.net//user_impersonation","https://management.core.windows.net//.default"],
"skip_account_creation": true,
"token_endpoint": "https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token"
}
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/<SUBNET_NAME>?api-version=2024-07-01'
cli.azure.cli.core.sdk.policies: Request method: 'PUT'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'Content-Length': '162'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': ''
cli.azure.cli.core.sdk.policies: 'CommandName': 'network vnet subnet create'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--resource-group --vnet-name --name --address-prefixes --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.76.0 (HOMEBREW) azsdk-python-core/1.35.0 Python/3.12.11 (macOS-XX.X.X-XXXX-XXX-64bit)'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: {"name": "<SUBNET_NAME>", "properties": {"addressPrefix": "<CIDR_BLOCK>", "privateEndpointNetworkPolicies": "Disabled", "privateLinkServiceNetworkPolicies": "Enabled"}}
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "PUT /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/<SUBNET_NAME>?api-version=2024-07-01 HTTP/1.1" 200 481
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers: { 'x-ms-request-id': '', 'Azure-AsyncOperation': 'https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Network/locations//operations/?api-version=2024-07-01&<REDACTED_QUERY>', ... }
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"name":"<SUBNET_NAME>","id":"/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/<SUBNET_NAME>","etag":"W/""","properties":{"provisioningState":"Updating","addressPrefix":"<CIDR_BLOCK>","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled"},"type":"Microsoft.Network/virtualNetworks/subnets"}
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Network/locations//operations/?api-version=2024-07-01&<REDACTED_QUERY>'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers: { 'x-ms-client-request-id': '', 'User-Agent': 'AZURECLI/2.76.0 (...)', 'Authorization': '' }
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Network/locations//operations/?api-version=2024-07-01&<REDACTED_QUERY> HTTP/1.1" 200 23
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers: { 'x-ms-request-id': '', 'x-ms-operation-identifier': 'tenantId=<TENANT_ID>,objectId=<OBJECT_ID>//' , ... }
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"status":"InProgress"}
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Network/locations//operations/?api-version=2024-07-01&<REDACTED_QUERY>'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers: { 'x-ms-client-request-id': '', ... }
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Network/locations//operations/?api-version=2024-07-01&<REDACTED_QUERY> HTTP/1.1" 200 22
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers: { 'x-ms-request-id': '', 'x-ms-operation-identifier': 'tenantId=<TENANT_ID>,objectId=<OBJECT_ID>//', ... }
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"status":"Succeeded"}
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/<SUBNET_NAME>?api-version=2024-07-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers: { 'x-ms-client-request-id': '', 'Authorization': '', ... }
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/<SUBNET_NAME>?api-version=2024-07-01 HTTP/1.1" 200 482
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers: { 'ETag': 'W/""', 'x-ms-request-id': '', ... }
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"name":"<SUBNET_NAME>","id":"/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/<SUBNET_NAME>","etag":"W/""","properties":{"provisioningState":"Succeeded","addressPrefix":"<CIDR_BLOCK>","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled"},"type":"Microsoft.Network/virtualNetworks/subnets"}
cli.knack.cli: Event: CommandInvoker.OnTransformResult [<function _resource_group_transform at 0x*****>, <function _x509_from_base64_to_hex_transform at 0x********>]
cli.knack.cli: Event: CommandInvoker.OnFilterResult []
{
"addressPrefix": "<CIDR_BLOCK>",
"delegations": [],
"etag": "W/""",
"id": "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>/providers/Microsoft.Network/virtualNetworks/<VNET_NAME>/subnets/<SUBNET_NAME>",
"name": "<SUBNET_NAME>",
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled",
"provisioningState": "Succeeded",
"resourceGroup": "<RG_NAME>",
"type": "Microsoft.Network/virtualNetworks/subnets"
}
cli.knack.cli: Event: Cli.SuccessfulExecute []
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x********>]
az_command_data_logger: exit code: 0
cli.main: Command ran in 19.486 seconds (init: 0.822, invoke: 18.664)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4024 in cache file under /.azure/telemetry/
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/opt/homebrew/Cellar/azure-cli/2.76.0/libexec/bin/python /opt/homebrew/Cellar/azure-cli/2.76.0/libexec/lib/python3.12/site-packages/azure/cli/telemetry/init.py /.azure /.azure/telemetry/"
telemetry.process: Return from creating process
telemetry.main: Finish creating telemetry upload process.

Expected behavior

Like in ARM Template/Bicep or Terraform deployment, it should create addrressPrefixes (string[]) not addressPrefix (string).

Environment Summary

azure-cli 2.76.0

core 2.76.0
telemetry 1.1.0

Extensions:
azure-firewall 1.3.0

Dependencies:
msal 1.33.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/homebrew/Cellar/azure-cli/2.76.0/libexec/bin/python'
Config directory '/Users/michal/.azure'
Extensions directory '/Users/michal/.azure/cliextensions'

Python (Darwin) 3.12.11 (main, Jun 3 2025, 15:41:47) [Clang 17.0.0 (clang-1700.0.13.3)]

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[necusjz]

@smereczynski could you plz provide the cli command using on,
This situation causes lack of possibility to create (using CLI) subnet that will be possible to allocate in Network Manager IPAM IP address pool?

besides, it seems we only has addressPrefix (string) no addressPrefixes (array of strings), why cannot populate both address prefix and address prefixes?

[smereczynski]

@smereczynski could you plz provide the cli command using on, This situation causes lack of possibility to create (using CLI) subnet that will be possible to allocate in Network Manager IPAM IP address pool?

If you are asking about command to create subnet, you have it on top. If you are asking about Network Manager IPAM IP allocation, then it is not a command. I'm doing it from the portal. Maybe there is a CLI command but I did not tried it yet. Updating vNet/Subnet when adding to pool is causing this error:

Invalid configuration on subnet /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/rg-maugp-poc-11-plc/providers/Microsoft.Network/virtualNetworks/vnet-maugp-poc-11-plc/subnets/default; cannot populate both address prefix and address prefixes.

[necusjz]

could you please try the cli approach as well? the input parameters should be like,

--ipam-allocations [0].id={pool_id} [0].number-of-ip-addresses=10

[smereczynski]

@necusjz az network vnet create --location polandcentral --resource-group rg-maugp-poc-12-plc --name vnet-maugp-poc-12-plc --ipam-allocations "[0].id=/subscriptions/<subscription_id/resourceGroups/rg-maugp-poc-plc/providers/Microsoft.Network/networkManagers/netman-maugp-poc-plc/ipamPools/pool1" "[0].number-of-ip-addresses=65536" works correctly.