11 TypeSpec changes for Network and Vmss

+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/openapi";
+import "@typespec/rest";
+import "./models.tsp";
+import "./FirewallPolicy.tsp";
+import "../Common/main.tsp";
+
+using TypeSpec.Rest;
+using Azure.ResourceManager;
+using TypeSpec.Http;
+using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
+using Common;
+
+namespace Microsoft.Network;
+/**
+ * Firewall Policy Kubernetes Selector Group resource.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-private-usage" "@Http.Private.includeInapplicableMetadataInPayload is required to preserve the existing firewall policy sub-resource payload shape produced by the original Swagger."
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "KubeSelectorGroup extends SubResourceModel to preserve the existing id-only firewall policy sub-resource envelope from the original Swagger; inheritance is required for wire-format compatibility."
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "firewallPolicy child resources use the ARM Legacy custom-resource pattern; @parentResource(FirewallPolicy) with Legacy.feature is required to match the existing firewall policy resource hierarchy."
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "firewallPolicy uses the ARM Legacy resource pattern; @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy) is required to keep KubeSelectorGroup consistent with the parent firewall policy resource tree."
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+@parentResource(FirewallPolicy)
+@Http.Private.includeInapplicableMetadataInPayload(false)
+@added(Versions.v2025_09_01)
+model FirewallPolicyKubeSelectorGroup extends SubResourceModel {
+  properties?: FirewallPolicyKubeSelectorGroupProperties;
+
+  /**
+   * The name of the resource that is unique within a resource group. This name can be used to access the resource.
+   */
+  @visibility(Lifecycle.Read)
+  @path
+  @key("kubeSelectorGroupName")
+  @segment("kubeSelectorGroups")
+  @pattern("^[a-zA-Z0-9]([a-zA-Z0-9-._]{0,78}[a-zA-Z0-9_])?$")
+  name: string;
+
+  /** A unique read-only string that changes whenever the resource is updated. */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "etag is an existing firewall policy sub-resource envelope property carried over from the original Swagger for optimistic concurrency; it must remain on the resource model."
+  @visibility(Lifecycle.Read)
+  etag?: string;
+}
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "These operations target the KubeSelectorGroup child of firewallPolicy, which uses the ARM Legacy resource pattern; @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy) is required for consistency with the parent firewall policy resource tree."
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+@added(Versions.v2025_09_01)
+@armResourceOperations
+interface FirewallPolicyKubeSelectorGroups {
+  /**
+   * Gets the specified FirewallPolicyKubeSelectorGroup.
+   */
+  get is ArmResourceRead<FirewallPolicyKubeSelectorGroup, Error = CloudError>;
+
+  /**
+   * Creates or updates the specified FirewallPolicyKubeSelectorGroup.
+   */
+  createOrUpdate is ArmResourceCreateOrReplaceAsync<
+    FirewallPolicyKubeSelectorGroup,
+    Error = CloudError
+  >;
+
+  /**
+   * Deletes the specified FirewallPolicyKubeSelectorGroup.
+   */
+  delete is ArmResourceDeleteWithoutOkAsync<
+    FirewallPolicyKubeSelectorGroup,
+    Error = CloudError
+  >;
+
+  /**
+   * Lists all FirewallPolicyKubeSelectorGroups in a FirewallPolicy resource.
+   */
+  list is ArmResourceListByParent<
+    FirewallPolicyKubeSelectorGroup,
+    Error = CloudError
+  >;
+}
+
+@@doc(
+  FirewallPolicyKubeSelectorGroup.name,
+  "The name of the FirewallPolicyKubeSelectorGroup."
+);
+@@doc(
+  FirewallPolicyKubeSelectorGroup.name,
+  "The name of the resource that is unique within a resource group. This name can be used to access the resource."
+);
+@@doc(
+  FirewallPolicyKubeSelectorGroup.properties,
+  "The properties of the firewall policy Kubernetes selector group."
+);
+@@doc(
+  FirewallPolicyKubeSelectorGroups.createOrUpdate::parameters.resource,
+  "Parameters supplied to the create or update FirewallPolicyKubeSelectorGroup operation."
+);

 import "@azure-tools/typespec-azure-resource-manager";
 import "@typespec/openapi";
 import "@typespec/rest";
+import "@typespec/versioning";
 import "./models.tsp";
 import "../Common/main.tsp";
 

 using Azure.ResourceManager;
 using TypeSpec.Http;
 using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
 using Common;
 
 namespace Microsoft.Network;

   @tag("FirewallPolicies")
   createOrUpdate is ArmResourceCreateOrReplaceAsync<
     FirewallPolicy,
+    Parameters = {
+      /**
+       * Indicates that the write originates from AFC (Azure Firewall for Containers) and is permitted to modify an AFC-managed Firewall Policy.
+       */
+      @added(Versions.v2025_09_01)
+      @query("afcManagedSync")
+      afcManagedSync?: boolean;
+    },
     Error = CloudError
   >;
 

 }
 
 /**
- * SKU of a service gateway.
+ * SKU of a service gateway.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewaySku {
+  /**
+   * Name of a service gateway SKU.
+   */
+  name?: ServiceGatewaySkuName;
+
+  /**
+   * Tier of a service gateway SKU.
+   */
+  tier?: ServiceGatewaySkuTier;
+}
+
+/**
+ * Properties of the service gateway update address locations request.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayUpdateAddressLocationsRequest {
+  /**
+   * Specifies the type of update operation to perform on address locations within the service gateway.
+   *
+   * - FullUpdate: Replaces all existing address location data with the new list provided in the request. Any previously defined locations not included will be removed.
+   * - PartialUpdate: Updates only the specified address locations.
+   */
+  action?: UpdateAction;
+
+  /**
+   * An array of address locations to create or update.
+   */
+  @identifiers(#["addressLocation"])
+  addressLocations?: ServiceGatewayAddressLocation[];
+}
+
+/**
+ * Properties of the service gateway address location.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayAddressLocation {
+  /**
+   * Location to update
+   */
+  addressLocation?: string;
+
+  /**
+   * Specifies the type of update operation to perform on addresses within the address location of service gateway.
+   *
+   * - FullUpdate: Replaces all existing address data with the new list provided in the request. Any previously defined addresses not included will be removed.
+   * - PartialUpdate: Updates only the specified addresses.
+   */
+  addressUpdateAction?: AddressUpdateAction;
+
+  /**
+   * An array of addresses to create or update in locations.
+   */
+  @identifiers(#["address"])
+  addresses?: ServiceGatewayAddress[];
+}
+
+/**
+ * Properties of the service gateway address.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayAddress {
+  /**
+   * Address to update
+   */
+  address?: string;
+
+  /**
+   * Collection of services in address.
+   */
+  services?: string[];
+}
+
+/**
+ * Properties of the service gateway update services request.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayUpdateServicesRequest {
+  /**
+   * Specifies the type of update operation to perform on services within the service gateway.
+   *
+   * - FullUpdate: Replaces all existing services with the new list provided in the request. Any previously defined services not included will be removed.
+   * - PartialUpdate: Updates only the specified services.
+   */
+  action?: ServiceUpdateAction;
+
+  /**
+   * Collection of service updates.
+   */
+  @identifiers(#["service/name"])
+  serviceRequests?: ServiceGatewayServiceRequest[];
+}
+
+/**
+ * Properties of the service gateway services request.
+ */
+#suppress "@azure-tools/typespec-client-generator-core/csharp-model-suffix" "Name kept for backward compatibility"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayServiceRequest {
+  /**
+   * Set to true to mark the service for deletion.
+   */
+  isDelete?: boolean;
+
+  /**
+   * Service of service gateway.
+   */
+  service?: ServiceGatewayService;
+}
+
+/**
+ * Properties of the service gateway service.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayService {
+  /**
+   * Name of the service
+   */
+  name?: string;
+
+  /**
+   * Properties of service gateway service.
+   */
+  properties?: ServiceGatewayServicePropertiesFormat;
+}
+
+/**
+ * Properties of the service gateway service.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayServicePropertiesFormat {
+  /**
+   * Name of the service.
+   */
+  serviceType?: ServiceType;
+
+  /**
+   * Set to true to mark default service for inbound or outbound.
+   */
+  isDefault?: boolean;
+
+  /**
+   * An array of load balancer backend address pools.
+   */
+  loadBalancerBackendPools?: BackendAddressPool[];
+
+  /**
+   * Azure Resource Id of public natgateway.
+   */
+  publicNatGatewayId?: string;
+}
+
+/**
+ * Response for get service gateway address locations.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model GetServiceGatewayAddressLocationsResult
+  is Azure.Core.Page<ServiceGatewayAddressLocationResponse>;
+
+/**
+ * Properties of the service gateway address location.
+ */
+#suppress "@azure-tools/typespec-client-generator-core/csharp-model-suffix" "Name kept for backward compatibility"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model ServiceGatewayAddressLocationResponse {
+  /**
+   * Location to update
+   */
+  addressLocation?: string;
+
+  /**
+   * An array of addresses to create or update in locations.
+   */
+  @identifiers(#["address"])
+  addresses?: ServiceGatewayAddress[];
+}
+
+/**
+ * Response for get service gateway services.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
+model GetServiceGatewayServicesResult is Azure.Core.Page<ServiceGatewayService>;
+
+/**
+ * VirtualNetworkAppliance properties.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetworkAppliance)
+model VirtualNetworkAppliancePropertiesFormat {
+  /**
+   * Bandwidth of the VirtualNetworkAppliance resource in Gbps.
+   */
+  @typeChangedFrom(Versions.v2025_07_01, string)
+  bandwidthInGbps?: float64;
+
+  /**
+   * A list of IPConfigurations of the virtual network appliance.
+   */
+  @visibility(Lifecycle.Read)
+  ipConfigurations?: VirtualNetworkApplianceIpConfiguration[];
+
+  /**
+   * Whether the specific virtual network appliance is IPv4 or Dual Stack. Default is IPv4.
+   */
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "Consistent with existing Azure Network naming convention using 'IP' for IP-related properties"
+  @added(Versions.v2025_07_01)
+  privateIPAddressVersion?: VirtualNetworkApplianceIpVersionType;
+
+  /**
+   * The provisioning state of the virtual network appliance resource.
+   */
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
+
+  /**
+   * The resource GUID property of the virtual network appliance resource.
+   */
+  @visibility(Lifecycle.Read)
+  resourceGuid?: string;
+
+  /**
+   * The reference to the subnet resource.
+   */
+  subnet?: Subnet;
+}
+
+/**
+ * IP address version.
+ */
+@added(Versions.v2025_07_01)
+union VirtualNetworkApplianceIpVersionType {
+  string,
+
+  /** IPv4 version */
+  IPv4: "IPv4",
+
+  /** Dual Stack version */
+  DualStack: "DualStack",
+}
+
+/**
+ * The virtual network appliance ip configuration.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "For backward compatibility"
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetworkAppliance)
+model VirtualNetworkApplianceIpConfiguration extends SubResource {
+  /**
+   * Properties of the virtual network appliance ip configuration.
+   */
+  properties?: VirtualNetworkApplianceIpConfigurationProperties;
+
+  /**
+   * The name of virtual network appliance ip configuration.
+   */
+  name?: string;
+
+  /**
+   * A unique read-only string that changes whenever the resource is updated.
+   */
+  @visibility(Lifecycle.Read)
+  etag?: string;
+
+  /**
+   * The resource type.
+   */
+  @visibility(Lifecycle.Read)
+  type?: string;
+}
+
+/**
+ * Properties of virtual network appliance IP configuration.
+ */
+#suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetworkAppliance)
+model VirtualNetworkApplianceIpConfigurationProperties {
+  /**
+   * The private IP address of the IP configuration.
+   */
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  privateIPAddress?: string;
+
+  /**
+   * The private IP address allocation method.
+   */
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  privateIPAllocationMethod?: IPAllocationMethod;
+
+  /**
+   * Whether the ip configuration is primary or not.
+   */
+  primary?: boolean;
+
+  /**
+   * The provisioning state of the private link service IP configuration resource.
+   */
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
+
+  /**
+   * Whether the specific IP configuration is IPv4 or IPv6. Default is IPv4.
+   */
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  privateIPAddressVersion?: IPVersion;
+}
+@@identifiers(
+  GetServiceGatewayAddressLocationsResult.value,
+  #["addressLocation"]
+);
+@@identifiers(GetServiceGatewayServicesResult.value, #["name"]);
+// =============================================================================
+// Connection Analyzer (api-version 2025-09-01)
+// =============================================================================
+
+/**
+ * The type of diagnostic operation to run on a connection analyzer.
+ */
+@added(Versions.v2025_09_01)
+union DiagnosticOperation {
+  string,
+
+  /**
+   * Determines the next hop for traffic from the source to the destination.
+   */
+  NextHop: "NextHop",
+
+  /**
+   * Evaluates the network security group rules that apply to the traffic.
+   */
+  NSG: "NSG",
+
+  /**
+   * Scans the destination ports to determine their reachability.
+   */
+  PortScan: "PortScan",
+
+  /**
+   * Performs an end-to-end connectivity check between the source and destination.
+   */
+  ConnectivityCheck: "ConnectivityCheck",
+
+  /**
+   * Runs Express Route specific diagnostics for the connection.
+   */
+  ExpressRouteDiagnostic: "ExpressRouteDiagnostic",
+}
+
+namespace ConnectionAnalyzerEndpointTypes {
+  /**
+   * The endpoint type for a connection analyzer source or destination.
+   */
+  @added(Versions.v2025_09_01)
+  union EndpointType {
+    string,
+
+    /**
+     * An Azure virtual machine endpoint, identified by its ARM resource ID.
+     */
+    VM: "VM",
+
+    /**
+     * An Azure virtual machine scale set (or scale set instance) endpoint, identified by its ARM resource ID.
+     */
+    VMSS: "VMSS",
+
+    /**
+     * An external endpoint reachable from outside Azure, identified by an IP address or FQDN.
+     */
+    ExternalAddress: "ExternalAddress",
+
+    /**
+     * An Azure Bastion host endpoint, identified by its ARM resource ID.
+     */
+    BastionHost: "BastionHost",
+
+    /**
+     * An Application Gateway endpoint, identified by its ARM resource ID.
+     */
+    ApplicationGateway: "ApplicationGateway",
+  }
+}
+
+/**
+ * Current execution status of the connection analyzer.
+ */
+@added(Versions.v2025_09_01)
+union ConnectionAnalyzerStatus {
+  string,
+
+  /**
+   * The connection analyzer has been created but execution has not yet begun.
+   */
+  NotStarted: "NotStarted",
+
+  /**
+   * The connection analyzer is currently running its diagnostic operations.
+   */
+  Running: "Running",
+
+  /**
+   * The connection analyzer completed all diagnostic operations successfully.
+   */
+  Succeeded: "Succeeded",
+
+  /**
+   * The connection analyzer failed to complete its diagnostic operations.
+   */
+  Failed: "Failed",
+}
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+@doc("""
+  Describes a source or destination endpoint of a connection analyzer.
+  
+  The schema is intentionally permissive (a flat object) because the set of
+  valid fields is determined by `type` and is enforced server-side by the
+  Network Resource Provider. The required and allowed fields per `type` are:
+  
+  - `VM`, `VMSS`, `BastionHost`, `ApplicationGateway`: `resourceId` is
+    required and must be the ARM resource ID of the corresponding resource
+    (a virtual machine, virtual machine scale set or VMSS instance, Azure
+    Bastion host, or Application Gateway, respectively); `address` is not
+    used; `port` is optional.
+  - `ExternalAddress`: `address` is required and must be an IP address or
+    FQDN reachable from outside Azure; `resourceId` is not used; `port` is
+    optional.
+  
+  Requests that supply fields not allowed for the chosen `type`, or omit a
+  required field, are rejected by the service with a validation error. This
+  follows the same convention used by `ConnectivitySource` and
+  `ConnectivityDestination` on Network Watcher.
+  """)
+model ConnectionAnalyzerEndpoint {
+  /**
+   * The type of the endpoint. Determines which of `resourceId` and `address`
+   * are required; see the model-level documentation for the per-type contract.
+   */
+  type: ConnectionAnalyzerEndpointTypes.EndpointType;
+
+  /**
+   * ARM resource ID of the endpoint resource. Required when `type` is `VM`,
+   * `VMSS`, `BastionHost`, or `ApplicationGateway`. Not used when `type` is
+   * `ExternalAddress`.
+   */
+  resourceId?: armResourceIdentifier;
+
+  /**
+   * IP address or FQDN of the endpoint. Required when `type` is
+   * `ExternalAddress`. Not used for the resource-typed endpoint kinds (`VM`,
+   * `VMSS`, `BastionHost`, `ApplicationGateway`).
+   */
+  address?: string;
+
+  /**
+   * Port to use for the endpoint (0-65535).
+   */
+  @minValue(0)
+  @maxValue(65535)
+  port?: int32;
+}
+
+/**
+ * Settings that control how connectivity checks are performed by the connection analyzer.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewaySku {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model ConnectivityCheckSettings {
   /**
-   * Name of a service gateway SKU.
+   * Whether to generate a hop-by-hop path during the connectivity check. Default value is true.
    */
-  name?: ServiceGatewaySkuName;
+  generatePath?: boolean = true;
 
   /**
-   * Tier of a service gateway SKU.
+   * Preferred IP version for the connectivity check.
    */
-  tier?: ServiceGatewaySkuTier;
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "Property name preserves uppercase 'IP' acronym to remain consistent with existing Microsoft.Network properties named preferredIPVersion."
+  preferredIPVersion?: PreferredIPVersion;
 }
 
 /**
- * Properties of the service gateway update address locations request.
+ * Settings that control how Express Route diagnostics are performed by the connection analyzer.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayUpdateAddressLocationsRequest {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model ExpressRouteDiagnosticsSettings {
   /**
-   * Specifies the type of update operation to perform on address locations within the service gateway.
-   *
-   * - FullUpdate: Replaces all existing address location data with the new list provided in the request. Any previously defined locations not included will be removed.
-   * - PartialUpdate: Updates only the specified address locations.
+   * Resource ID of the Express Route circuit.
    */
-  action?: UpdateAction;
+  erCircuitResourceId?: Azure.Core.armResourceIdentifier<[
+    {
+      type: "Microsoft.Network/expressRouteCircuits";
+    }
+  ]>;
 
   /**
-   * An array of address locations to create or update.
+   * Bandwidth (in Mbps) to use for the Express Route diagnostic.
    */
-  @identifiers(#["addressLocation"])
-  addressLocations?: ServiceGatewayAddressLocation[];
+  bandwidth?: float32;
 }
 
 /**
- * Properties of the service gateway address location.
+ * Diagnostic settings to provide for the ConnectionAnalyzer operation.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayAddressLocation {
-  /**
-   * Location to update
-   */
-  addressLocation?: string;
-
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model DiagnosticOperationsSettings {
   /**
-   * Specifies the type of update operation to perform on addresses within the address location of service gateway.
-   *
-   * - FullUpdate: Replaces all existing address data with the new list provided in the request. Any previously defined addresses not included will be removed.
-   * - PartialUpdate: Updates only the specified addresses.
+   * Settings for the ConnectivityCheck diagnostic operation.
    */
-  addressUpdateAction?: AddressUpdateAction;
+  connectivityCheckSettings?: ConnectivityCheckSettings;
 
   /**
-   * An array of addresses to create or update in locations.
+   * Settings for the ExpressRouteDiagnostic diagnostic operation.
    */
-  @identifiers(#["address"])
-  addresses?: ServiceGatewayAddress[];
+  expressRouteDiagnosticsSettings?: ExpressRouteDiagnosticsSettings;
 }
 
 /**
- * Properties of the service gateway address.
+ * Protocol-level settings for the connection analyzer.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayAddress {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model ProtocolSettings {
   /**
-   * Address to update
+   * Network protocol.
    */
-  address?: string;
+  protocol?: Protocol;
 
   /**
-   * Collection of services in address.
+   * HTTP configuration (used when protocol is Http or Https).
    */
-  services?: string[];
+  httpConfiguration?: HttpConfiguration;
 }
 
 /**
- * Properties of the service gateway update services request.
+ * Storage account where the connection analyzer writes its output.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayUpdateServicesRequest {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model StorageAccountSettings {
   /**
-   * Specifies the type of update operation to perform on services within the service gateway.
-   *
-   * - FullUpdate: Replaces all existing services with the new list provided in the request. Any previously defined services not included will be removed.
-   * - PartialUpdate: Updates only the specified services.
+   * Resource ID of the storage account.
    */
-  action?: ServiceUpdateAction;
+  storageAccountId: Azure.Core.armResourceIdentifier<[
+    {
+      type: "Microsoft.Storage/storageAccounts";
+    }
+  ]>;
 
   /**
-   * Collection of service updates.
+   * Sub-path within the storage account where results are written.
    */
-  @identifiers(#["service/name"])
-  serviceRequests?: ServiceGatewayServiceRequest[];
+  path?: string;
 }
 
 /**
- * Properties of the service gateway services request.
+ * Settings that control where the connection analyzer writes its results.
  */
-#suppress "@azure-tools/typespec-client-generator-core/csharp-model-suffix" "Name kept for backward compatibility"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayServiceRequest {
-  /**
-   * Set to true to mark the service for deletion.
-   */
-  isDelete?: boolean;
-
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model OutputSettings {
   /**
-   * Service of service gateway.
+   * Storage account where output is written.
    */
-  service?: ServiceGatewayService;
+  storageAccountSettings?: StorageAccountSettings;
 }
 
 /**
- * Properties of the service gateway service.
+ * Properties of a connection analyzer.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayService {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model ConnectionAnalyzerProperties {
   /**
-   * Name of the service
+   * Source endpoint of the connection analyzer.
    */
-  name?: string;
+  source: ConnectionAnalyzerEndpoint;
 
   /**
-   * Properties of service gateway service.
+   * Destination endpoint of the connection analyzer.
    */
-  properties?: ServiceGatewayServicePropertiesFormat;
-}
+  destination: ConnectionAnalyzerEndpoint;
 
-/**
- * Properties of the service gateway service.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayServicePropertiesFormat {
   /**
-   * Name of the service.
+   * List of diagnostic operations to run.
    */
-  serviceType?: ServiceType;
+  @minItems(1)
+  diagnosticOperations: DiagnosticOperation[];
 
   /**
-   * Set to true to mark default service for inbound or outbound.
+   * Protocol-level settings.
    */
-  isDefault?: boolean;
+  protocolSettings?: ProtocolSettings;
 
   /**
-   * An array of load balancer backend address pools.
+   * Per-operation diagnostic settings.
    */
-  loadBalancerBackendPools?: BackendAddressPool[];
+  diagnosticOperationsSettings?: DiagnosticOperationsSettings;
 
   /**
-   * Azure Resource Id of public natgateway.
+   * Time-to-live (days) before the analyzer expires.
    */
-  publicNatGatewayId?: string;
-}
+  @minValue(1)
+  expiryInDays?: int32;
 
-/**
- * Response for get service gateway address locations.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model GetServiceGatewayAddressLocationsResult
-  is Azure.Core.Page<ServiceGatewayAddressLocationResponse>;
+  /**
+   * Output settings (e.g. storage account).
+   */
+  outputSettings?: OutputSettings;
 
-/**
- * Properties of the service gateway address location.
- */
-#suppress "@azure-tools/typespec-client-generator-core/csharp-model-suffix" "Name kept for backward compatibility"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model ServiceGatewayAddressLocationResponse {
   /**
-   * Location to update
+   * UTC time when the connection analyzer request was received.
    */
-  addressLocation?: string;
+  @visibility(Lifecycle.Read)
+  requestTime?: utcDateTime;
 
   /**
-   * An array of addresses to create or update in locations.
+   * The provisioning state of the connection analyzer resource.
    */
-  @identifiers(#["address"])
-  addresses?: ServiceGatewayAddress[];
-}
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 
-/**
- * Response for get service gateway services.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
-model GetServiceGatewayServicesResult is Azure.Core.Page<ServiceGatewayService>;
+  /**
+   * Current execution status of the connection analyzer.
+   */
+  @visibility(Lifecycle.Read)
+  status?: ConnectionAnalyzerStatus;
+}
 
 /**
- * VirtualNetworkAppliance properties.
+ * Defines a connection analyzer resource.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetworkAppliance)
-model VirtualNetworkAppliancePropertiesFormat {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "ConnectionAnalyzer is exposed via the legacy NetworkWatcher action pattern; its key is supplied by the routed operation, not modeled on the resource."
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "Connection Analyzer follows the existing legacy custom-resource pattern used by sibling NetworkWatcher child resources in this project."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
+model ConnectionAnalyzer {
   /**
-   * Bandwidth of the VirtualNetworkAppliance resource in Gbps.
+   * Name of the connection analyzer.
    */
-  @typeChangedFrom(Versions.v2025_07_01, string)
-  bandwidthInGbps?: float64;
+  @visibility(Lifecycle.Read)
+  name?: string;
 
   /**
-   * A list of IPConfigurations of the virtual network appliance.
+   * Resource ID of the connection analyzer.
    */
   @visibility(Lifecycle.Read)
-  ipConfigurations?: VirtualNetworkApplianceIpConfiguration[];
+  id?: string;
 
   /**
-   * Whether the specific virtual network appliance is IPv4 or Dual Stack. Default is IPv4.
+   * Resource type.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "Consistent with existing Azure Network naming convention using 'IP' for IP-related properties"
-  @added(Versions.v2025_07_01)
-  privateIPAddressVersion?: VirtualNetworkApplianceIpVersionType;
+  @visibility(Lifecycle.Read)
+  type?: string;
 
   /**
-   * The provisioning state of the virtual network appliance resource.
+   * A unique read-only string that changes whenever the resource is updated.
    */
   @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  etag?: string;
 
   /**
-   * The resource GUID property of the virtual network appliance resource.
+   * Resource location.
+   */
+  @visibility(Lifecycle.Read, Lifecycle.Create)
+  location: string;
+
+  /**
+   * Resource tags.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "ARM resource tags must be modeled as Record<string> per the ARM resource contract."
+  tags?: Record<string>;
+
+  /**
+   * Azure Resource Manager metadata containing createdBy and modifiedBy information.
    */
   @visibility(Lifecycle.Read)
-  resourceGuid?: string;
+  systemData?: SystemData;
 
   /**
-   * The reference to the subnet resource.
+   * Properties of the connection analyzer.
    */
-  subnet?: Subnet;
+  properties: ConnectionAnalyzerProperties;
 }
 
 /**
- * IP address version.
+ * List of connection analyzers.
  */
-@added(Versions.v2025_07_01)
-union VirtualNetworkApplianceIpVersionType {
-  string,
-
-  /** IPv4 version */
-  IPv4: "IPv4",
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model ConnectionAnalyzerListResult {
+  /**
+   * Information about connection analyzers.
+   */
+  @pageItems
+  value?: ConnectionAnalyzer[];
 
-  /** Dual Stack version */
-  DualStack: "DualStack",
+  /**
+   * URL to get the next set of results.
+   */
+  @nextLink
+  nextLink?: string;
 }
 
 /**
- * The virtual network appliance ip configuration.
+ * Result of an individual diagnostic operation run by a connection analyzer.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "For backward compatibility"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetworkAppliance)
-model VirtualNetworkApplianceIpConfiguration extends SubResource {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model DiagnosticOperationResult {
   /**
-   * Properties of the virtual network appliance ip configuration.
+   * The diagnostic operation that was run.
    */
-  properties?: VirtualNetworkApplianceIpConfigurationProperties;
+  diagnosticOperation: DiagnosticOperation;
 
   /**
-   * The name of virtual network appliance ip configuration.
+   * Error encountered while running the diagnostic operation, if any.
    */
-  name?: string;
+  error?: string;
 
   /**
-   * A unique read-only string that changes whenever the resource is updated.
+   * The result of the diagnostic operation, serialized as a JSON string.
+   *
+   * The payload shape varies by `diagnosticOperation`. For example, a
+   * `ConnectivityCheck` operation returns a JSON object such as
+   * `{ "ConnectivityStatus": "Reachable" }`. Consumers should parse this
+   * string as JSON according to the corresponding diagnostic operation.
    */
-  @visibility(Lifecycle.Read)
-  etag?: string;
+  result?: string;
+}
 
+/**
+ * Status result returned when querying a connection analyzer for its diagnostic results.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Required to attach Connection Analyzer child models to the existing NetworkWatcher resource which is modeled with the legacy ARM resource pattern via Azure.ResourceManager.Legacy.feature."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
+model ConnectionAnalyzerQueryStatusResult {
   /**
-   * The resource type.
+   * Resource ID of the connection analyzer.
    */
   @visibility(Lifecycle.Read)
-  type?: string;
-}
+  id?: string;
 
-/**
- * Properties of virtual network appliance IP configuration.
- */
-#suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetworkAppliance)
-model VirtualNetworkApplianceIpConfigurationProperties {
   /**
-   * The private IP address of the IP configuration.
+   * Current execution status of the connection analyzer.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  privateIPAddress?: string;
+  connectionAnalyzerStatus?: ConnectionAnalyzerStatus;
 
   /**
-   * The private IP address allocation method.
+   * Error message if the connection analyzer operation failed.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  privateIPAllocationMethod?: IPAllocationMethod;
+  error?: string;
 
   /**
-   * Whether the ip configuration is primary or not.
+   * Storage path where the connection analyzer output is written.
    */
-  primary?: boolean;
+  outputStoragePath?: string;
 
   /**
-   * The provisioning state of the private link service IP configuration resource.
+   * UTC time when the connection analyzer expires.
    */
-  @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  expiryInUtc?: utcDateTime;
 
   /**
-   * Whether the specific IP configuration is IPv4 or IPv6. Default is IPv4.
+   * Results of the individual diagnostic operations.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  privateIPAddressVersion?: IPVersion;
+  @identifiers(#["diagnosticOperation"])
+  diagnosticOperationResults?: DiagnosticOperationResult[];
 }
-@@identifiers(
-  GetServiceGatewayAddressLocationsResult.value,
-  #["addressLocation"]
-);
-@@identifiers(GetServiceGatewayServicesResult.value, #["name"]);
+
 @@added(DisablePeeringRoute, Versions.v2025_07_01);
 @@added(RouteTablePropertiesFormat.disablePeeringRoute, Versions.v2025_07_01);
 

 using Azure.ResourceManager;
 using TypeSpec.Http;
 using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
 using Common;
 
 namespace Microsoft.Network;

   }
 >;
 
+alias ConnectionAnalyzerOps = Azure.ResourceManager.Legacy.RoutedOperations<
+  {
+    ...ApiVersionParameter;
+    ...SubscriptionIdParameter;
+    ...ResourceGroupParameter;
+
+    /** The name of the network watcher. */
+    @path
+    @segment("networkWatchers")
+    @key
+    @pattern("^[0-9a-zA-Z]([0-9a-zA-Z_.-]{0,62}[0-9a-zA-Z_])?$")
+    networkWatcherName: string;
+  },
+  {
+    /** The name of the connection analyzer. */
+    @path
+    @segment("connectionAnalyzers")
+    @key
+    @pattern("^[0-9a-zA-Z]([0-9a-zA-Z_.-]{0,62}[0-9a-zA-Z_])?$")
+    connectionAnalyzerName: string;
+  },
+  ResourceRoute = #{
+    route: "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/connectionAnalyzers/{connectionAnalyzerName}",
+  }
+>;
+
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkWatcher)
 @armResourceOperations(#{ allowStaticRoutes: true, omitTags: true })

     ArmResponse<PacketCaptureListResult>,
     Error = ErrorResponse
   >;
+
+  /**
+   * Creates or updates a connection analyzer in the specified network watcher.
+   */
+  @added(Versions.v2025_09_01)
+  @tag("ConnectionAnalyzers")
+  @Azure.Core.useFinalStateVia("azure-async-operation")
+  @put
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/connectionAnalyzers/{connectionAnalyzerName}")
+  connectionAnalyzersCreate is ConnectionAnalyzerOps.ActionAsync<
+    NetworkWatcher,
+    ConnectionAnalyzer,
+    ConnectionAnalyzer,
+    Response =
+      | ArmResourceUpdatedResponse<ConnectionAnalyzer>
+      | ArmResourceCreatedResponse<
+          ConnectionAnalyzer,
+          LroHeaders = ArmAsyncOperationHeader<FinalResult = ConnectionAnalyzer> &
+            Azure.Core.Foundations.RetryAfterHeader
+        >,
+    OverrideErrorType = ErrorResponse
+  >;
+
+  /**
+   * Gets the specified connection analyzer by name.
+   */
+  @added(Versions.v2025_09_01)
+  @tag("ConnectionAnalyzers")
+  @get
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/connectionAnalyzers/{connectionAnalyzerName}")
+  connectionAnalyzersGet is ConnectionAnalyzerOps.ActionSync<
+    NetworkWatcher,
+    void,
+    Response = ArmResponse<ConnectionAnalyzer>,
+    OverrideErrorType = ErrorResponse
+  >;
+
+  /**
+   * Deletes the specified connection analyzer.
+   */
+  @added(Versions.v2025_09_01)
+  @tag("ConnectionAnalyzers")
+  @delete
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/connectionAnalyzers/{connectionAnalyzerName}")
+  connectionAnalyzersDelete is ConnectionAnalyzerOps.ActionAsync<
+    NetworkWatcher,
+    void,
+    void,
+    Response = ArmDeleteAcceptedLroResponse | ArmDeletedNoContentResponse,
+    OverrideErrorType = ErrorResponse
+  >;
+
+  /**
+   * Updates the tags of the specified connection analyzer.
+   */
+  @added(Versions.v2025_09_01)
+  @tag("ConnectionAnalyzers")
+  @patch(#{ implicitOptionality: false })
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/connectionAnalyzers/{connectionAnalyzerName}")
+  connectionAnalyzersUpdateTags is ConnectionAnalyzerOps.ActionSync<
+    NetworkWatcher,
+    TagsObject,
+    Response = ArmResponse<ConnectionAnalyzer>,
+    OverrideErrorType = ErrorResponse
+  >;
+
+  /**
+   * Lists all connection analyzers in the specified network watcher.
+   */
+  @added(Versions.v2025_09_01)
+  @tag("ConnectionAnalyzers")
+  @list
+  @get
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/connectionAnalyzers")
+  connectionAnalyzersList(
+    ...ApiVersionParameter,
+    ...SubscriptionIdParameter,
+    ...ResourceGroupParameter,
+
+    /** The name of the network watcher. */
+    @path
+    @pattern("^[0-9a-zA-Z]([0-9a-zA-Z_.-]{0,62}[0-9a-zA-Z_])?$")
+    networkWatcherName: string,
+  ): ArmResponse<ConnectionAnalyzerListResult> | ErrorResponse;
+
+  /**
+   * Queries the specified connection analyzer for diagnostic results.
+   */
+  @added(Versions.v2025_09_01)
+  @tag("ConnectionAnalyzers")
+  @Azure.Core.useFinalStateVia("azure-async-operation")
+  @post
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/connectionAnalyzers/{connectionAnalyzerName}/query")
+  connectionAnalyzersQuery is ConnectionAnalyzerOps.ActionAsync<
+    NetworkWatcher,
+    void,
+    ConnectionAnalyzerQueryStatusResult,
+    Response =
+      | ArmResponse<ConnectionAnalyzerQueryStatusResult>
+      | ArmAcceptedLroResponse<
+          "Operation succeeded.",
+          LroHeaders = ArmLroLocationHeader<FinalResult = ConnectionAnalyzerQueryStatusResult> &
+            ArmAsyncOperationHeader<FinalResult = ConnectionAnalyzerQueryStatusResult> &
+            Azure.Core.Foundations.RetryAfterHeader
+        >,
+    OverrideErrorType = ErrorResponse
+  >;
 }
 
 @@doc(NetworkWatcher.name, "The name of the network watcher.");

   NetworkWatchers.create::parameters.body,
   "Parameters that define the create packet capture operation."
 );
+@@doc(
+  NetworkWatchers.connectionAnalyzersCreate::parameters.body,
+  "Parameters that define the operation to create a connection analyzer."
+);
+@@doc(
+  NetworkWatchers.connectionAnalyzersUpdateTags::parameters.body,
+  "Parameters supplied to update connection analyzer tags."
+);

 using Azure.ResourceManager;
 using TypeSpec.Http;
 using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
 using Common;
 
 namespace Microsoft.Network;

     Error = CloudError
   >;
 
+  /**
+   * This operation retrieves a list of effective routes for the virtual network gateway.
+   */
+  @added(Versions.v2025_09_01)
+  @tag("VirtualNetworkGateways")
+  getEffectiveRoutes is ArmResourceActionAsync<
+    VirtualNetworkGateway,
+    void,
+    GatewayEffectiveRouteListResult,
+    Error = CloudError
+  >;
+
   /**
    * This operation retrieves the resiliency information for an Express Route Gateway, including the gateway's current resiliency score and recommendations to further improve the score
    */

 import "@azure-tools/typespec-azure-resource-manager";
 import "@typespec/openapi";
 import "@typespec/rest";
+import "@typespec/versioning";
 import "./models.tsp";
 import "../Common/VirtualNetwork.tsp";
 
 using TypeSpec.Rest;
+using TypeSpec.Versioning;
 using Azure.ResourceManager;
 using TypeSpec.Http;
 using TypeSpec.OpenAPI;

     },
     Error = CloudError
   >;
+
+  /**
+   * Move IP configurations from one virtual network to another.
+   */
+  #suppress "@azure-tools/typespec-azure-core/invalid-final-state" "azure-async-operation used for LRO polling"
+  @added(Versions.v2025_09_01)
+  @tag("VirtualNetworks")
+  @action("moveIpConfigurations")
+  @Azure.Core.useFinalStateVia("azure-async-operation")
+  moveIpConfigurations is ArmResourceActionAsync<
+    VirtualNetwork,
+    MoveIpConfigurationsRequest,
+    Response = {
+      @body body: void;
+    },
+    LroHeaders = ArmAsyncOperationHeader<FinalResult = void> &
+      ArmLroLocationHeader<FinalResult = void> &
+      Azure.Core.Foundations.RetryAfterHeader,
+    Error = CloudError
+  >;
 }
 
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"

   VirtualNetworks.updateTags::parameters.properties,
   "Parameters supplied to update virtual network tags."
 );
+@@doc(
+  VirtualNetworks.moveIpConfigurations::parameters.body,
+  "Parameters supplied to move IP configurations from one virtual network to another."
+);
 @@doc(
   EffectiveConfigurations.listNetworkManagerEffectiveConnectivityConfigurations::parameters.body,
   "Parameters supplied to list correct page."

 }
 
 /**
- * The resource model definition for a Azure Resource Manager proxy resource. It will not have tags and a location
+ * The resource model definition for an Azure Resource Manager tracked top level resource which has 'tags' and a 'location'
  */
 #suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/no-empty-model" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@summary("Proxy Resource")
+@summary("Tracked Resource")
 @Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
-model CommonProxyResource extends CommonResource {}
-
-/**
- * Properties of the IpAllocation.
- */
-#suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model IpAllocationPropertiesFormat {
-  /**
-   * The Subnet that using the prefix of this IpAllocation resource.
-   */
-  @visibility(Lifecycle.Read)
-  subnet?: SubResource;
-
+model CommonTrackedResource extends CommonResource {
   /**
-   * The VirtualNetwork that using the prefix of this IpAllocation resource.
+   * Resource tags.
    */
-  @visibility(Lifecycle.Read)
-  virtualNetwork?: SubResource;
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read, Lifecycle.Create, Lifecycle.Update)
+  tags?: Record<string>;
 
   /**
-   * The type for the IpAllocation.
+   * The geo-location where the resource lives
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-duplicate-property" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  type?: IpAllocationType;
+  @visibility(Lifecycle.Read, Lifecycle.Create)
+  location: string;
+}
 
+/**
+ * Common fields that are returned in the response for all Azure Resource Manager resources
+ */
+@summary("Resource")
+model CommonResource {
   /**
-   * The address prefix for the IpAllocation.
+   * Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
    */
-  prefix?: string;
+  @visibility(Lifecycle.Read)
+  id?: Azure.Core.armResourceIdentifier;
 
   /**
-   * The address prefix length for the IpAllocation.
+   * The name of the resource
    */
-  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  prefixLength?: int32 | null = 0;
+  @visibility(Lifecycle.Read)
+  name?: string;
 
   /**
-   * The address prefix Type for the IpAllocation.
+   * The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    */
-  prefixType?: IPVersion;
+  @visibility(Lifecycle.Read)
+  type?: string;
 
   /**
-   * The IPAM allocation ID.
+   * Azure Resource Manager metadata containing createdBy and modifiedBy information.
    */
-  ipamAllocationId?: string;
+  @visibility(Lifecycle.Read)
+  systemData?: SystemData;
+}
 
+/**
+ * Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
+ */
+#suppress "@azure-tools/typespec-client-generator-core/csharp-model-suffix" "Name kept for backward compatibility"
+@error
+@summary("Error response")
+model CommonErrorResponse {
   /**
-   * IpAllocation tags.
+   * The error object.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  allocationTags?: Record<string>;
+  error?: CommonErrorDetail;
 }
 
 /**
- * The IpGroups property information.
+ * The error detail.
  */
-#suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model IpGroupPropertiesFormat {
+model CommonErrorDetail {
   /**
-   * The provisioning state of the IpGroups resource.
+   * The error code.
    */
   @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  code?: string;
 
   /**
-   * IpAddresses/IpAddressPrefixes in the IpGroups resource.
+   * The error message.
    */
-  ipAddresses?: string[];
+  @visibility(Lifecycle.Read)
+  message?: string;
 
   /**
-   * List of references to Firewall resources that this IpGroups is associated with.
+   * The error target.
    */
   @visibility(Lifecycle.Read)
-  firewalls?: SubResource[];
+  target?: string;
 
   /**
-   * List of references to Firewall Policies resources that this IpGroups is associated with.
+   * The error details.
    */
   @visibility(Lifecycle.Read)
-  firewallPolicies?: SubResource[];
-}
+  @identifiers(#["message", "target"])
+  details?: CommonErrorDetail[];
 
-/**
- * The request for a VIP swap.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model LoadBalancerVipSwapRequest {
   /**
-   * A list of frontend IP configuration resources that should swap VIPs.
+   * The error additional info.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  frontendIPConfigurations?: LoadBalancerVipSwapRequestFrontendIPConfiguration[];
+  @visibility(Lifecycle.Read)
+  @identifiers(#[])
+  additionalInfo?: CommonErrorAdditionalInfo[];
 }
 
 /**
- * VIP swap request's frontend IP configuration object.
+ * The resource management error additional info.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model LoadBalancerVipSwapRequestFrontendIPConfiguration {
-  /**
-   * The ID of frontend IP configuration resource.
-   */
-  id?: string;
-
+model CommonErrorAdditionalInfo {
   /**
-   * The properties of VIP swap request's frontend IP configuration object.
+   * The additional info type.
    */
-  properties?: LoadBalancerVipSwapRequestFrontendIPConfigurationProperties;
-}
+  @visibility(Lifecycle.Read)
+  type?: string;
 
-/**
- * The properties of VIP swap request's frontend IP configuration object.
- */
-#suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model LoadBalancerVipSwapRequestFrontendIPConfigurationProperties {
   /**
-   * A reference to public IP address resource.
+   * The additional info.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  publicIPAddress?: SubResource;
+  #suppress "@azure-tools/typespec-azure-core/no-unknown" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read)
+  info?: unknown;
 }
 
 /**
- * The request for a QueryInboundNatRulePortMapping API. Either IpConfiguration or IpAddress should be set
+ * Represents the IpamPool update API request interface.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model QueryInboundNatRulePortMappingRequest {
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model IpamPoolUpdate {
   /**
-   * NetworkInterfaceIPConfiguration set in load balancer backend address.
+   * Dictionary of <string>
    */
-  #suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
-  ipConfiguration?: SubResource;
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "For backward compatibility"
+  tags?: Record<string>;
 
   /**
-   * IP address set in load balancer backend address.
+   * Represents the IpamPool update properties.
    */
-  ipAddress?: string;
+  properties?: IpamPoolUpdateProperties;
 }
 
 /**
- * The response for a QueryInboundNatRulePortMapping API.
+ * Represents the IpamPool update properties.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model BackendAddressInboundNatRulePortMappings {
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model IpamPoolUpdateProperties {
+  #suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  description?: string;
+
   /**
-   * Collection of inbound NAT rule port mappings.
+   * String representing a friendly name for the resource.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/missing-x-ms-identifiers" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  inboundNatRulePortMappings?: InboundNatRulePortMapping[];
+  displayName?: string;
 }
 
 /**
- * Individual port mappings for inbound NAT rule created for backend pool.
+ * IpamPool usage information.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model InboundNatRulePortMapping {
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model PoolUsage {
   /**
-   * Name of inbound NAT rule.
+   * List of IP address prefixes of the resource.
    */
   @visibility(Lifecycle.Read)
-  inboundNatRuleName?: string;
+  addressPrefixes?: string[];
 
   /**
-   * The reference to the transport protocol used by the inbound NAT rule.
+   * List of IpamPool that are children of this IpamPool.
    */
   @visibility(Lifecycle.Read)
-  protocol?: TransportProtocol;
+  @identifiers(#["resourceId"])
+  childPools?: ResourceBasics[];
 
   /**
-   * Frontend port.
+   * List of assigned IP address prefixes.
    */
   @visibility(Lifecycle.Read)
-  frontendPort?: int32;
+  allocatedAddressPrefixes?: string[];
 
   /**
-   * Backend port.
+   * List of reserved IP address prefixes. These IP addresses could be reclaimed if not assigned in the given time.
    */
   @visibility(Lifecycle.Read)
-  backendPort?: int32;
-}
-
-/**
- * The response for a Health API.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model LoadBalancerHealthPerRule {
-  /**
-   * Number of backend instances associated to the LB rule that are considered healthy.
-   */
-  up?: int32;
-
-  /**
-   * Number of backend instances associated to the LB rule that are considered unhealthy.
-   */
-  down?: int32;
+  reservedAddressPrefixes?: string[];
 
   /**
-   * Information about the health per rule of the backend addresses.
+   * List of available IP address prefixes.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/missing-x-ms-identifiers" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  loadBalancerBackendAddresses?: LoadBalancerHealthPerRulePerBackendAddress[];
-}
+  @visibility(Lifecycle.Read)
+  availableAddressPrefixes?: string[];
 
-/**
- * The information about health per rule per backend address.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model LoadBalancerHealthPerRulePerBackendAddress {
   /**
-   * The IP address belonging to the backend address.
+   * Total number of IP addresses managed in the IpamPool.
    */
-  ipAddress?: string;
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read)
+  totalNumberOfIPAddresses?: string;
 
   /**
-   * Resource ID of the Network Interface IP Configuration.
+   * Total number of assigned IP addresses in the IpamPool.
    */
   #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  networkInterfaceIPConfigurationId?: string;
+  @visibility(Lifecycle.Read)
+  numberOfAllocatedIPAddresses?: string;
 
   /**
-   * The current health of the backend instances that is associated to the LB rule.
+   * Total number of reserved IP addresses in the IpamPool.
    */
-  state?: string;
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read)
+  numberOfReservedIPAddresses?: string;
 
   /**
-   * The explanation of the State
+   * Total number of available IP addresses in the IpamPool.
    */
-  reason?: string;
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read)
+  numberOfAvailableIPAddresses?: string;
 }
 
 /**
- * The request for a migrateToIpBased API.
+ * Representation of basic resource information.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model MigrateLoadBalancerToIpBasedRequest {
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model ResourceBasics {
   /**
-   * A list of pool names that should be migrated from Nic based to IP based pool
+   * ResourceId of the Azure resource.
    */
-  pools?: string[];
-}
+  resourceId?: Azure.Core.armResourceIdentifier;
 
-/**
- * The response for a migrateToIpBased API.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
-model MigratedPools {
   /**
-   * A list of pools migrated from Nic based to IP based pool
+   * List of IP address prefixes of the resource.
    */
-  #suppress "@azure-tools/typespec-client-generator-core/property-name-conflict" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  migratedPools?: string[];
+  addressPrefixes?: string[];
 }
 
 /**
- * Response for list effective route API service call.
+ * List of PoolAssociation
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model EffectiveRouteListResult is Azure.Core.Page<EffectiveRoute>;
-@@visibility(EffectiveRouteListResult.nextLink, Lifecycle.Read);
+model PoolAssociationList is Azure.Core.Page<PoolAssociation>;
 
 /**
- * Effective Route.
+ * IpamPool association information.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model EffectiveRoute {
+model PoolAssociation {
   /**
-   * The name of the user defined route. This is optional.
+   * Resource id of the associated Azure resource.
    */
-  name?: string;
+  resourceId: Azure.Core.armResourceIdentifier;
 
   /**
-   * If true, on-premises routes are not propagated to the network interfaces in the subnet.
+   * IpamPool id for which the resource is associated to.
    */
-  disableBgpRoutePropagation?: boolean;
+  poolId?: Azure.Core.armResourceIdentifier;
+
+  #suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  description?: string;
 
   /**
-   * Who created the route.
+   * List of assigned IP address prefixes in the IpamPool of the associated resource.
    */
-  source?: EffectiveRouteSource;
+  @visibility(Lifecycle.Read)
+  addressPrefixes?: string[];
 
   /**
-   * The value of effective route.
+   * List of reserved IP address prefixes in the IpamPool of the associated resource.
    */
-  state?: EffectiveRouteState;
+  @visibility(Lifecycle.Read)
+  reservedPrefixes?: string[];
 
   /**
-   * The address prefixes of the effective routes in CIDR notation.
+   * Total number of assigned IP addresses of the association.
    */
-  addressPrefix?: string[];
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read)
+  totalNumberOfIPAddresses?: string;
 
   /**
-   * The IP address of the next hop of the effective route.
+   * Total number of reserved IP addresses of the association.
    */
-  nextHopIpAddress?: string[];
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read)
+  numberOfReservedIPAddresses?: string;
 
   /**
-   * The type of Azure hop the packet should be sent to.
+   * Creation time of the association.
    */
-  nextHopType?: RouteNextHopType;
+  @visibility(Lifecycle.Read)
+  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
+  createdAt?: utcDateTime;
+
+  /**
+   * Expire time for IP addresses reserved.
+   */
+  @visibility(Lifecycle.Read)
+  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
+  reservationExpiresAt?: utcDateTime;
 }
 
 /**
- * Response for list effective network security groups API service call.
+ * List of StaticCidr
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model EffectiveNetworkSecurityGroupListResult
-  is Azure.Core.Page<EffectiveNetworkSecurityGroup>;
-@@visibility(EffectiveNetworkSecurityGroupListResult.nextLink, Lifecycle.Read);
+model StaticCidrList is Azure.Core.Page<StaticCidr>;
 
 /**
- * Effective network security group.
+ * Properties of static CIDR resource.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model EffectiveNetworkSecurityGroup {
+model StaticCidrProperties {
+  #suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  description?: string;
+
   /**
-   * The ID of network security group that is applied.
+   * Number of IP addresses to allocate for a static CIDR resource. The IP addresses will be assigned based on IpamPools available space.
    */
-  networkSecurityGroup?: SubResource;
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  numberOfIPAddressesToAllocate?: string;
 
   /**
-   * Associated resources.
+   * List of IP address prefixes of the resource.
    */
-  association?: EffectiveNetworkSecurityGroupAssociation;
+  addressPrefixes?: string[];
 
   /**
-   * A collection of effective security rules.
+   * Total number of IP addresses allocated for the static CIDR resource.
    */
-  effectiveSecurityRules?: EffectiveNetworkSecurityRule[];
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  @visibility(Lifecycle.Read)
+  totalNumberOfIPAddresses?: string;
 
   /**
-   * Mapping of tags to list of IP Addresses included within the tag.
+   * Provisioning states of a resource.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  tagMap?: Record<string[]>;
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 }
 
 /**
- * The effective network security group association.
+ * The resource model definition for a Azure Resource Manager proxy resource. It will not have tags and a location
+ */
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-resource-manager/no-empty-model" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@summary("Proxy Resource")
+@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
+model CommonProxyResource extends CommonResource {}
+
+/**
+ * Properties of the IpAllocation.
  */
+#suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model EffectiveNetworkSecurityGroupAssociation {
+model IpAllocationPropertiesFormat {
   /**
-   * The ID of the Azure network manager if assigned.
+   * The Subnet that using the prefix of this IpAllocation resource.
    */
-  networkManager?: SubResource;
+  @visibility(Lifecycle.Read)
+  subnet?: SubResource;
 
   /**
-   * The ID of the subnet if assigned.
+   * The VirtualNetwork that using the prefix of this IpAllocation resource.
    */
-  subnet?: SubResource;
+  @visibility(Lifecycle.Read)
+  virtualNetwork?: SubResource;
 
   /**
-   * The ID of the network interface if assigned.
+   * The type for the IpAllocation.
    */
-  networkInterface?: SubResource;
-}
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-duplicate-property" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  type?: IpAllocationType;
 
-/**
- * Effective network security rules.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model EffectiveNetworkSecurityRule {
   /**
-   * The name of the security rule specified by the user (if created by the user).
+   * The address prefix for the IpAllocation.
    */
-  name?: string;
+  prefix?: string;
 
   /**
-   * The network protocol this rule applies to.
+   * The address prefix length for the IpAllocation.
    */
-  protocol?: EffectiveSecurityRuleProtocol;
+  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  prefixLength?: int32 | null = 0;
 
   /**
-   * The source port or range.
+   * The address prefix Type for the IpAllocation.
    */
-  sourcePortRange?: string;
+  prefixType?: IPVersion;
 
   /**
-   * The destination port or range.
+   * The IPAM allocation ID.
    */
-  destinationPortRange?: string;
+  ipamAllocationId?: string;
 
   /**
-   * The source port ranges. Expected values include a single integer between 0 and 65535, a range using '-' as separator (e.g. 100-400), or an asterisk (*).
+   * IpAllocation tags.
    */
-  sourcePortRanges?: string[];
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  allocationTags?: Record<string>;
+}
 
+/**
+ * The IpGroups property information.
+ */
+#suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model IpGroupPropertiesFormat {
   /**
-   * The destination port ranges. Expected values include a single integer between 0 and 65535, a range using '-' as separator (e.g. 100-400), or an asterisk (*).
+   * The provisioning state of the IpGroups resource.
    */
-  destinationPortRanges?: string[];
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 
   /**
-   * The source address prefix.
+   * IpAddresses/IpAddressPrefixes in the IpGroups resource.
    */
-  sourceAddressPrefix?: string;
+  ipAddresses?: string[];
 
   /**
-   * The destination address prefix.
+   * List of references to Firewall resources that this IpGroups is associated with.
    */
-  destinationAddressPrefix?: string;
+  @visibility(Lifecycle.Read)
+  firewalls?: SubResource[];
 
   /**
-   * The source address prefixes. Expected values include CIDR IP ranges, Default Tags (VirtualNetwork, AzureLoadBalancer, Internet), System Tags, and the asterisk (*).
+   * List of references to Firewall Policies resources that this IpGroups is associated with.
    */
-  sourceAddressPrefixes?: string[];
+  @visibility(Lifecycle.Read)
+  firewallPolicies?: SubResource[];
+}
 
+/**
+ * The request for a VIP swap.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model LoadBalancerVipSwapRequest {
   /**
-   * The destination address prefixes. Expected values include CIDR IP ranges, Default Tags (VirtualNetwork, AzureLoadBalancer, Internet), System Tags, and the asterisk (*).
+   * A list of frontend IP configuration resources that should swap VIPs.
    */
-  destinationAddressPrefixes?: string[];
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  frontendIPConfigurations?: LoadBalancerVipSwapRequestFrontendIPConfiguration[];
+}
 
+/**
+ * VIP swap request's frontend IP configuration object.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model LoadBalancerVipSwapRequestFrontendIPConfiguration {
   /**
-   * The expanded source address prefix.
+   * The ID of frontend IP configuration resource.
    */
-  expandedSourceAddressPrefix?: string[];
+  id?: string;
 
   /**
-   * Expanded destination address prefix.
+   * The properties of VIP swap request's frontend IP configuration object.
    */
-  expandedDestinationAddressPrefix?: string[];
+  properties?: LoadBalancerVipSwapRequestFrontendIPConfigurationProperties;
+}
 
+/**
+ * The properties of VIP swap request's frontend IP configuration object.
+ */
+#suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model LoadBalancerVipSwapRequestFrontendIPConfigurationProperties {
   /**
-   * Whether network traffic is allowed or denied.
+   * A reference to public IP address resource.
    */
-  access?: SecurityRuleAccess;
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  publicIPAddress?: SubResource;
+}
 
+/**
+ * The request for a QueryInboundNatRulePortMapping API. Either IpConfiguration or IpAddress should be set
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model QueryInboundNatRulePortMappingRequest {
   /**
-   * The priority of the rule.
+   * NetworkInterfaceIPConfiguration set in load balancer backend address.
    */
-  priority?: int32;
+  #suppress "@azure-tools/typespec-client-generator-core/csharp-use-standard-acronyms" "Name kept for backward compatibility"
+  ipConfiguration?: SubResource;
 
   /**
-   * The direction of the rule.
+   * IP address set in load balancer backend address.
    */
-  direction?: SecurityRuleDirection;
+  ipAddress?: string;
 }
 
 /**
- * Properties of Managed Network
+ * The response for a QueryInboundNatRulePortMapping API.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerProperties {
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model BackendAddressInboundNatRulePortMappings {
   /**
-   * A description of the network manager.
+   * Collection of inbound NAT rule port mappings.
    */
-  description?: string;
+  #suppress "@azure-tools/typespec-azure-resource-manager/missing-x-ms-identifiers" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  inboundNatRulePortMappings?: InboundNatRulePortMapping[];
+}
 
+/**
+ * Individual port mappings for inbound NAT rule created for backend pool.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model InboundNatRulePortMapping {
   /**
-   * Scope of Network Manager.
+   * Name of inbound NAT rule.
    */
-  networkManagerScopes: NetworkManagerPropertiesNetworkManagerScopes;
+  @visibility(Lifecycle.Read)
+  inboundNatRuleName?: string;
 
   /**
-   * Scope Access.
+   * The reference to the transport protocol used by the inbound NAT rule.
    */
-  networkManagerScopeAccesses?: ConfigurationType[];
+  @visibility(Lifecycle.Read)
+  protocol?: TransportProtocol;
 
   /**
-   * The provisioning state of the network manager resource.
+   * Frontend port.
    */
   @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  frontendPort?: int32;
 
   /**
-   * Unique identifier for this resource.
+   * Backend port.
    */
   @visibility(Lifecycle.Read)
-  resourceGuid?: string;
+  backendPort?: int32;
 }
 
 /**
- * Scope of Network Manager.
+ * The response for a Health API.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerPropertiesNetworkManagerScopes {
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model LoadBalancerHealthPerRule {
   /**
-   * List of management groups.
+   * Number of backend instances associated to the LB rule that are considered healthy.
    */
-  managementGroups?: string[];
+  up?: int32;
 
   /**
-   * List of subscriptions.
+   * Number of backend instances associated to the LB rule that are considered unhealthy.
    */
-  subscriptions?: string[];
+  down?: int32;
 
   /**
-   * List of cross tenant scopes.
+   * Information about the health per rule of the backend addresses.
    */
-  @visibility(Lifecycle.Read)
-  @identifiers(#[])
-  crossTenantScopes?: CrossTenantScopes[];
+  #suppress "@azure-tools/typespec-azure-resource-manager/missing-x-ms-identifiers" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  loadBalancerBackendAddresses?: LoadBalancerHealthPerRulePerBackendAddress[];
 }
 
 /**
- * Cross tenant scopes.
+ * The information about health per rule per backend address.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model CrossTenantScopes {
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model LoadBalancerHealthPerRulePerBackendAddress {
   /**
-   * Tenant ID.
+   * The IP address belonging to the backend address.
    */
-  @visibility(Lifecycle.Read)
-  tenantId?: string;
+  ipAddress?: string;
 
   /**
-   * List of management groups.
+   * Resource ID of the Network Interface IP Configuration.
    */
-  @visibility(Lifecycle.Read)
-  managementGroups?: string[];
+  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  networkInterfaceIPConfigurationId?: string;
 
   /**
-   * List of subscriptions.
+   * The current health of the backend instances that is associated to the LB rule.
    */
-  @visibility(Lifecycle.Read)
-  subscriptions?: string[];
+  state?: string;
+
+  /**
+   * The explanation of the State
+   */
+  reason?: string;
 }
 
 /**
- * Object for patch operations.
+ * The request for a migrateToIpBased API.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model PatchObject {
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model MigrateLoadBalancerToIpBasedRequest {
   /**
-   * Resource tags.
+   * A list of pool names that should be migrated from Nic based to IP based pool
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  tags?: Record<string>;
+  pools?: string[];
 }
 
 /**
- * Network Manager Commit.
+ * The response for a migrateToIpBased API.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerCommit {
+@Azure.ResourceManager.Legacy.feature(Features.loadBalancer)
+model MigratedPools {
   /**
-   * Commit Id.
+   * A list of pools migrated from Nic based to IP based pool
    */
-  @visibility(Lifecycle.Read)
-  commitId?: string;
+  #suppress "@azure-tools/typespec-client-generator-core/property-name-conflict" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  migratedPools?: string[];
+}
 
-  /**
-   * List of target locations.
-   */
-  targetLocations: string[];
+/**
+ * Response for list effective route API service call.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model EffectiveRouteListResult is Azure.Core.Page<EffectiveRoute>;
+@@visibility(EffectiveRouteListResult.nextLink, Lifecycle.Read);
 
+/**
+ * Effective Route.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model EffectiveRoute {
   /**
-   * List of configuration ids.
+   * The name of the user defined route. This is optional.
    */
-  configurationIds?: string[];
+  name?: string;
 
   /**
-   * Commit Type.
+   * If true, on-premises routes are not propagated to the network interfaces in the subnet.
    */
-  commitType: ConfigurationType;
-}
+  disableBgpRoutePropagation?: boolean;
 
-/**
- * Network Manager Deployment Status Parameter.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerDeploymentStatusParameter {
   /**
-   * List of locations.
+   * Who created the route.
    */
-  regions?: string[];
+  source?: EffectiveRouteSource;
 
   /**
-   * List of deployment types.
+   * The value of effective route.
    */
-  deploymentTypes?: ConfigurationType[];
+  state?: EffectiveRouteState;
 
   /**
-   * Continuation token for pagination, capturing the next page size and offset, as well as the context of the query.
+   * The address prefixes of the effective routes in CIDR notation.
    */
-  skipToken?: string;
-}
+  addressPrefix?: string[];
 
-/**
- * A list of Network Manager Deployment Status
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerDeploymentStatusListResult {
   /**
-   * Gets a page of Network Manager Deployment Status
+   * The IP address of the next hop of the effective route.
    */
-  @pageItems
-  @identifiers(#[])
-  value?: NetworkManagerDeploymentStatus[];
+  nextHopIpAddress?: string[];
 
   /**
-   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
+   * The type of Azure hop the packet should be sent to.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  skipToken?: string;
+  nextHopType?: RouteNextHopType;
 }
 
 /**
- * Network Manager Deployment Status.
+ * Response for list effective network security groups API service call.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerDeploymentStatus {
-  /**
-   * Commit Time.
-   */
-  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
-  commitTime?: utcDateTime;
-
-  /**
-   * Region Name.
-   */
-  region?: string;
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model EffectiveNetworkSecurityGroupListResult
+  is Azure.Core.Page<EffectiveNetworkSecurityGroup>;
+@@visibility(EffectiveNetworkSecurityGroupListResult.nextLink, Lifecycle.Read);
 
+/**
+ * Effective network security group.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model EffectiveNetworkSecurityGroup {
   /**
-   * Deployment Status.
+   * The ID of network security group that is applied.
    */
-  deploymentStatus?: DeploymentStatus;
+  networkSecurityGroup?: SubResource;
 
   /**
-   * List of configuration ids.
+   * Associated resources.
    */
-  configurationIds?: string[];
+  association?: EffectiveNetworkSecurityGroupAssociation;
 
   /**
-   * Configuration Deployment Type.
+   * A collection of effective security rules.
    */
-  deploymentType?: ConfigurationType;
+  effectiveSecurityRules?: EffectiveNetworkSecurityRule[];
 
   /**
-   * Error Message.
+   * Mapping of tags to list of IP Addresses included within the tag.
    */
-  errorMessage?: string;
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  tagMap?: Record<string[]>;
 }
 
 /**
- * Effective Virtual Networks Parameter.
+ * The effective network security group association.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ActiveConfigurationParameter {
-  /**
-   * List of regions.
-   */
-  regions?: string[];
-
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model EffectiveNetworkSecurityGroupAssociation {
   /**
-   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
+   * The ID of the Azure network manager if assigned.
    */
-  skipToken?: string;
-}
+  networkManager?: SubResource;
 
-/**
- * Result of the request to list active connectivity configurations. It contains a list of active connectivity configurations and a skiptoken to get the next set of results.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ActiveConnectivityConfigurationsListResult {
   /**
-   * Gets a page of active connectivity configurations.
+   * The ID of the subnet if assigned.
    */
-  @pageItems
-  value?: ActiveConnectivityConfiguration[];
+  subnet?: SubResource;
 
   /**
-   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
+   * The ID of the network interface if assigned.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  skipToken?: string;
+  networkInterface?: SubResource;
 }
 
 /**
- * Active connectivity configuration.
+ * Effective network security rules.
  */
-#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ActiveConnectivityConfiguration
-  extends EffectiveConnectivityConfiguration {
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model EffectiveNetworkSecurityRule {
   /**
-   * Deployment time string.
+   * The name of the security rule specified by the user (if created by the user).
    */
-  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
-  commitTime?: utcDateTime;
+  name?: string;
 
   /**
-   * Deployment region.
+   * The network protocol this rule applies to.
    */
-  region?: string;
-}
+  protocol?: EffectiveSecurityRuleProtocol;
 
-/**
- * The network manager effective connectivity configuration
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model EffectiveConnectivityConfiguration {
   /**
-   * Connectivity configuration ID.
+   * The source port or range.
    */
-  id?: string;
+  sourcePortRange?: string;
 
   /**
-   * Properties of a network manager connectivity configuration
+   * The destination port or range.
    */
-  properties?: ConnectivityConfigurationProperties;
+  destinationPortRange?: string;
 
   /**
-   * Effective configuration groups.
+   * The source port ranges. Expected values include a single integer between 0 and 65535, a range using '-' as separator (e.g. 100-400), or an asterisk (*).
    */
-  configurationGroups?: ConfigurationGroup[];
-}
+  sourcePortRanges?: string[];
 
-/**
- * Properties of network manager connectivity configuration
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ConnectivityConfigurationProperties {
   /**
-   * A description of the connectivity configuration.
+   * The destination port ranges. Expected values include a single integer between 0 and 65535, a range using '-' as separator (e.g. 100-400), or an asterisk (*).
    */
-  description?: string;
+  destinationPortRanges?: string[];
 
   /**
-   * Connectivity topology type.
+   * The source address prefix.
    */
-  connectivityTopology: ConnectivityTopology;
+  sourceAddressPrefix?: string;
 
   /**
-   * List of hubItems
+   * The destination address prefix.
    */
-  @identifiers(#["resourceId"])
-  hubs?: Hub[];
+  destinationAddressPrefix?: string;
 
   /**
-   * Flag if global mesh is supported.
+   * The source address prefixes. Expected values include CIDR IP ranges, Default Tags (VirtualNetwork, AzureLoadBalancer, Internet), System Tags, and the asterisk (*).
    */
-  isGlobal?: IsGlobal;
+  sourceAddressPrefixes?: string[];
 
   /**
-   * Collection of additional settings to enhance specific topology behaviors of the connectivity configuration resource.
+   * The destination address prefixes. Expected values include CIDR IP ranges, Default Tags (VirtualNetwork, AzureLoadBalancer, Internet), System Tags, and the asterisk (*).
    */
-  connectivityCapabilities?: ConnectivityConfigurationPropertiesConnectivityCapabilities;
+  destinationAddressPrefixes?: string[];
 
   /**
-   * Groups for configuration
+   * The expanded source address prefix.
    */
-  @identifiers(#["networkGroupId"])
-  appliesToGroups: ConnectivityGroupItem[];
+  expandedSourceAddressPrefix?: string[];
 
   /**
-   * The provisioning state of the connectivity configuration resource.
+   * Expanded destination address prefix.
    */
-  @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  expandedDestinationAddressPrefix?: string[];
 
   /**
-   * Flag if need to remove current existing peerings.
+   * Whether network traffic is allowed or denied.
    */
-  deleteExistingPeering?: DeleteExistingPeering;
+  access?: SecurityRuleAccess;
 
   /**
-   * Unique identifier for this resource.
+   * The priority of the rule.
    */
-  @visibility(Lifecycle.Read)
-  resourceGuid?: string;
+  priority?: int32;
+
+  /**
+   * The direction of the rule.
+   */
+  direction?: SecurityRuleDirection;
 }
 
 /**
- * Hub Item.
+ * Properties of Managed Network
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model Hub {
+model NetworkManagerProperties {
   /**
-   * Resource Id.
+   * A description of the network manager.
    */
-  resourceId?: string;
+  description?: string;
 
   /**
-   * Resource Type.
+   * Scope of Network Manager.
    */
-  resourceType?: string;
-}
+  networkManagerScopes: NetworkManagerPropertiesNetworkManagerScopes;
 
-/**
- * Collection of additional settings to enhance specific topology behaviors of the connectivity configuration resource.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ConnectivityConfigurationPropertiesConnectivityCapabilities {
   /**
-   * Option indicating the scale of private endpoints allowed in the connected group of the connectivity configuration.
+   * Scope Access.
    */
-  connectedGroupPrivateEndpointsScale: ConnectedGroupPrivateEndpointsScale = ConnectedGroupPrivateEndpointsScale.Standard;
+  networkManagerScopeAccesses?: ConfigurationType[];
 
   /**
-   * Behavior to handle overlapped IP address space among members of the connected group of the connectivity configuration.
+   * The provisioning state of the network manager resource.
    */
-  connectedGroupAddressOverlap: ConnectedGroupAddressOverlap = ConnectedGroupAddressOverlap.Allowed;
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 
   /**
-   * Option indicating enforcement of peerings created by the connectivity configuration.
+   * Unique identifier for this resource.
    */
-  peeringEnforcement: PeeringEnforcement = PeeringEnforcement.Unenforced;
+  @visibility(Lifecycle.Read)
+  resourceGuid?: string;
 }
 
 /**
- * Connectivity group item.
+ * Scope of Network Manager.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ConnectivityGroupItem {
-  /**
-   * Network group Id.
-   */
-  networkGroupId: string;
-
+model NetworkManagerPropertiesNetworkManagerScopes {
   /**
-   * Flag if need to use hub gateway.
+   * List of management groups.
    */
-  useHubGateway?: UseHubGateway;
+  managementGroups?: string[];
 
   /**
-   * Flag if global is supported.
+   * List of subscriptions.
    */
-  isGlobal?: IsGlobal;
+  subscriptions?: string[];
 
   /**
-   * Group connectivity type.
+   * List of cross tenant scopes.
    */
-  groupConnectivity: GroupConnectivity;
+  @visibility(Lifecycle.Read)
+  @identifiers(#[])
+  crossTenantScopes?: CrossTenantScopes[];
 }
 
 /**
- * The network configuration group resource
+ * Cross tenant scopes.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ConfigurationGroup {
+model CrossTenantScopes {
   /**
-   * Network group ID.
+   * Tenant ID.
    */
-  id?: string;
+  @visibility(Lifecycle.Read)
+  tenantId?: string;
 
   /**
-   * The network configuration group properties
+   * List of management groups.
    */
-  properties?: NetworkGroupProperties;
+  @visibility(Lifecycle.Read)
+  managementGroups?: string[];
+
+  /**
+   * List of subscriptions.
+   */
+  @visibility(Lifecycle.Read)
+  subscriptions?: string[];
 }
 
 /**
- * Properties of network group
+ * Object for patch operations.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkGroupProperties {
+model PatchObject {
   /**
-   * A description of the network group.
+   * Resource tags.
    */
-  description?: string;
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  tags?: Record<string>;
+}
 
+/**
+ * Network Manager Commit.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model NetworkManagerCommit {
   /**
-   * The type of the group member.
+   * Commit Id.
    */
-  memberType?: GroupMemberType;
+  @visibility(Lifecycle.Read)
+  commitId?: string;
 
   /**
-   * The provisioning state of the scope assignment resource.
+   * List of target locations.
    */
-  @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  targetLocations: string[];
 
   /**
-   * Unique identifier for this resource.
+   * List of configuration ids.
    */
-  @visibility(Lifecycle.Read)
-  resourceGuid?: string;
+  configurationIds?: string[];
+
+  /**
+   * Commit Type.
+   */
+  commitType: ConfigurationType;
 }
 
 /**
- * Result of the request to list active security admin rules. It contains a list of active security admin rules and a skiptoken to get the next set of results.
+ * Network Manager Deployment Status Parameter.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model ActiveSecurityAdminRulesListResult {
+model NetworkManagerDeploymentStatusParameter {
   /**
-   * Gets a page of active security admin rules.
+   * List of locations.
    */
-  @pageItems
-  value?: ActiveBaseSecurityAdminRule[];
+  regions?: string[];
 
   /**
-   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
+   * List of deployment types.
+   */
+  deploymentTypes?: ConfigurationType[];
+
+  /**
+   * Continuation token for pagination, capturing the next page size and offset, as well as the context of the query.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
   skipToken?: string;
 }
 
 /**
- * Network base admin rule.
+ * A list of Network Manager Deployment Status
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-@discriminator("kind")
-model ActiveBaseSecurityAdminRule {
+model NetworkManagerDeploymentStatusListResult {
   /**
-   * Resource ID.
+   * Gets a page of Network Manager Deployment Status
    */
-  id?: string;
+  @pageItems
+  @identifiers(#[])
+  value?: NetworkManagerDeploymentStatus[];
 
   /**
-   * Deployment time string.
+   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
    */
-  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
-  commitTime?: utcDateTime;
+  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  skipToken?: string;
+}
 
+/**
+ * Network Manager Deployment Status.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model NetworkManagerDeploymentStatus {
   /**
-   * Deployment region.
+   * Commit Time.
    */
-  region?: string;
+  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
+  commitTime?: utcDateTime;
 
   /**
-   * A description of the security admin configuration.
+   * Region Name.
    */
-  configurationDescription?: string;
+  region?: string;
 
   /**
-   * A description of the rule collection.
+   * Deployment Status.
    */
-  ruleCollectionDescription?: string;
+  deploymentStatus?: DeploymentStatus;
 
   /**
-   * Groups for rule collection
+   * List of configuration ids.
    */
-  @identifiers(#[])
-  ruleCollectionAppliesToGroups?: NetworkManagerSecurityGroupItem[];
+  configurationIds?: string[];
 
   /**
-   * Effective configuration groups.
+   * Configuration Deployment Type.
    */
-  ruleGroups?: ConfigurationGroup[];
+  deploymentType?: ConfigurationType;
 
   /**
-   * Whether the rule is custom or default.
+   * Error Message.
    */
-  kind: EffectiveAdminRuleKind;
+  errorMessage?: string;
 }
 
 /**
- * Network manager security group item.
+ * Effective Virtual Networks Parameter.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerSecurityGroupItem {
+model ActiveConfigurationParameter {
   /**
-   * Network manager group Id.
+   * List of regions.
    */
-  networkGroupId: string;
+  regions?: string[];
+
+  /**
+   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
+   */
+  skipToken?: string;
 }
 
 /**
- * Information about the network manager connection.
+ * Result of the request to list active connectivity configurations. It contains a list of active connectivity configurations and a skiptoken to get the next set of results.
  */
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerConnectionProperties {
+model ActiveConnectivityConfigurationsListResult {
   /**
-   * Network Manager Id.
+   * Gets a page of active connectivity configurations.
    */
-  networkManagerId?: string;
+  @pageItems
+  value?: ActiveConnectivityConfiguration[];
 
   /**
-   * Connection state.
+   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
    */
-  @visibility(Lifecycle.Read)
-  connectionState?: ScopeConnectionState;
+  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  skipToken?: string;
+}
+
+/**
+ * Active connectivity configuration.
+ */
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model ActiveConnectivityConfiguration
+  extends EffectiveConnectivityConfiguration {
+  /**
+   * Deployment time string.
+   */
+  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
+  commitTime?: utcDateTime;
 
   /**
-   * A description of the network manager connection.
+   * Deployment region.
    */
-  description?: string;
+  region?: string;
 }
 
 /**
- * Common resource representation.
+ * The network manager effective connectivity configuration
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
-model WritableResource {
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model EffectiveConnectivityConfiguration {
   /**
-   * Resource ID.
+   * Connectivity configuration ID.
    */
   id?: string;
 
   /**
-   * Resource name.
+   * Properties of a network manager connectivity configuration
    */
-  name?: string;
+  properties?: ConnectivityConfigurationProperties;
 
   /**
-   * Resource type.
+   * Effective configuration groups.
    */
-  type?: string;
+  configurationGroups?: ConfigurationGroup[];
 }
 
 /**
- * Common resource representation.
+ * Properties of network manager connectivity configuration
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
-model TrackedResourceWithSettableName {
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model ConnectivityConfigurationProperties {
   /**
-   * Resource ID.
+   * A description of the connectivity configuration.
    */
-  id?: string;
+  description?: string;
 
   /**
-   * Resource name.
+   * Connectivity topology type.
    */
-  name?: string;
+  connectivityTopology: ConnectivityTopology;
 
   /**
-   * Resource type.
+   * List of hubItems
    */
-  @visibility(Lifecycle.Read)
-  type?: string;
+  @identifiers(#["resourceId"])
+  hubs?: Hub[];
 
   /**
-   * Resource location.
+   * Flag if global mesh is supported.
    */
-  location?: string;
+  isGlobal?: IsGlobal;
 
   /**
-   * Resource tags.
+   * Collection of additional settings to enhance specific topology behaviors of the connectivity configuration resource.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  tags?: Record<string>;
-}
+  connectivityCapabilities?: ConnectivityConfigurationPropertiesConnectivityCapabilities;
 
-/**
- * Common resource representation.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
-model TrackedResourceWithSettableIdOptionalLocation {
   /**
-   * Resource ID.
+   * Groups for configuration
    */
-  id?: string;
+  @identifiers(#["networkGroupId"])
+  appliesToGroups: ConnectivityGroupItem[];
 
   /**
-   * Resource name.
-   */
-  @visibility(Lifecycle.Read)
-  name?: string;
-
-  /**
-   * Resource type.
+   * The provisioning state of the connectivity configuration resource.
    */
   @visibility(Lifecycle.Read)
-  type?: string;
+  provisioningState?: ProvisioningState;
 
   /**
-   * Resource location.
+   * Flag if need to remove current existing peerings.
    */
-  location?: string;
+  deleteExistingPeering?: DeleteExistingPeering;
 
   /**
-   * Resource tags.
+   * Unique identifier for this resource.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  tags?: Record<string>;
+  @visibility(Lifecycle.Read)
+  resourceGuid?: string;
 }
 
 /**
- * Common resource representation.
+ * Hub Item.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
-model TrackedResourceWithOptionalLocation {
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model Hub {
   /**
-   * Resource ID.
+   * Resource Id.
    */
-  @visibility(Lifecycle.Read)
-  id?: string;
+  resourceId?: string;
 
   /**
-   * Resource name.
+   * Resource Type.
    */
-  @visibility(Lifecycle.Read)
-  name?: string;
+  resourceType?: string;
+}
 
+/**
+ * Collection of additional settings to enhance specific topology behaviors of the connectivity configuration resource.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model ConnectivityConfigurationPropertiesConnectivityCapabilities {
   /**
-   * Resource type.
+   * Option indicating the scale of private endpoints allowed in the connected group of the connectivity configuration.
    */
-  @visibility(Lifecycle.Read)
-  type?: string;
+  connectedGroupPrivateEndpointsScale: ConnectedGroupPrivateEndpointsScale = ConnectedGroupPrivateEndpointsScale.Standard;
 
   /**
-   * Resource location.
+   * Behavior to handle overlapped IP address space among members of the connected group of the connectivity configuration.
    */
-  location?: string;
+  connectedGroupAddressOverlap: ConnectedGroupAddressOverlap = ConnectedGroupAddressOverlap.Allowed;
 
   /**
-   * Resource tags.
+   * Option indicating enforcement of peerings created by the connectivity configuration.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  tags?: Record<string>;
+  peeringEnforcement: PeeringEnforcement = PeeringEnforcement.Unenforced;
 }
 
 /**
- * Proxy resource representation.
+ * Connectivity group item.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
-model ChildResource {
+@Azure.ResourceManager.Legacy.feature(Features.networkManager)
+model ConnectivityGroupItem {
   /**
-   * Resource ID.
+   * Network group Id.
    */
-  @visibility(Lifecycle.Read)
-  id?: string;
+  networkGroupId: string;
 
   /**
-   * Resource name.
+   * Flag if need to use hub gateway.
    */
-  @visibility(Lifecycle.Read)
-  name?: string;
+  useHubGateway?: UseHubGateway;
 
   /**
-   * Resource type.
+   * Flag if global is supported.
    */
-  @visibility(Lifecycle.Read)
-  type?: string;
+  isGlobal?: IsGlobal;
 
   /**
-   * A unique read-only string that changes whenever the resource is updated.
+   * Group connectivity type.
    */
-  @visibility(Lifecycle.Read)
-  etag?: string;
+  groupConnectivity: GroupConnectivity;
 }
 
 /**
- * Query Request Options
+ * The network configuration group resource
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model QueryRequestOptions {
+model ConfigurationGroup {
   /**
-   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
+   * Network group ID.
    */
-  skipToken?: string;
+  id?: string;
+
+  /**
+   * The network configuration group properties
+   */
+  properties?: NetworkGroupProperties;
 }
 
 /**
- * Result of the request to list networkManagerEffectiveConnectivityConfiguration. It contains a list of groups and a skiptoken to get the next set of results.
+ * Properties of network group
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerEffectiveConnectivityConfigurationListResult {
+model NetworkGroupProperties {
   /**
-   * Gets a page of NetworkManagerEffectiveConnectivityConfiguration
+   * A description of the network group.
    */
-  @pageItems
-  value?: EffectiveConnectivityConfiguration[];
+  description?: string;
 
   /**
-   * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.
+   * The type of the group member.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  skipToken?: string;
+  memberType?: GroupMemberType;
+
+  /**
+   * The provisioning state of the scope assignment resource.
+   */
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
+
+  /**
+   * Unique identifier for this resource.
+   */
+  @visibility(Lifecycle.Read)
+  resourceGuid?: string;
 }
 
 /**
- * Result of the request to list networkManagerEffectiveSecurityAdminRules. It contains a list of groups and a skiptoken to get the next set of results.
+ * Result of the request to list active security admin rules. It contains a list of active security admin rules and a skiptoken to get the next set of results.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.networkManager)
-model NetworkManagerEffectiveSecurityAdminRulesListResult {
+model ActiveSecurityAdminRulesListResult {
   /**
-   * Gets a page of NetworkManagerEffectiveSecurityAdminRules
+   * Gets a page of active security admin rules.
    */
   @pageItems
-  value?: EffectiveBaseSecurityAdminRule[];
+  value?: ActiveBaseSecurityAdminRule[];
 
   /**
    * When present, the value can be passed to a subsequent query call (together with the same query and scopes used in the current request) to retrieve the next page of data.

   weight?: int32;
 }
 
+/**
+ * List of virtual network gateway effective routes.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "This model is part of the existing Network Gateway resource type and must use legacy patterns for backward compatibility"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkGateway)
+model GatewayEffectiveRouteListResult {
+  /**
+   * List of gateway effective routes.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/missing-x-ms-identifiers" "Effective route items have no single stable identifier property to key on."
+  @pageItems
+  value?: GatewayEffectiveRoute[];
+}
+
+/**
+ * Gateway effective routing details.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "This model is part of the existing Network Gateway resource type and must use legacy patterns for backward compatibility"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.networkGateway)
+model GatewayEffectiveRoute {
+  /**
+   * The gateway's local address.
+   */
+  @visibility(Lifecycle.Read)
+  localAddress?: string;
+
+  /**
+   * The list of address prefixes for the effective route.
+   */
+  @visibility(Lifecycle.Read)
+  addressPrefixes?: string[];
+
+  /**
+   * The IP address of the next hop for the effective route.
+   */
+  @visibility(Lifecycle.Read)
+  nextHopIpAddress?: string;
+
+  /**
+   * The next hop type of the effective route.
+   */
+  @visibility(Lifecycle.Read)
+  nextHopType?: GatewayEffectiveRouteNextHopType;
+}
+
+/**
+ * The next hop type of a gateway effective route.
+ */
+@added(Versions.v2025_09_01)
+union GatewayEffectiveRouteNextHopType {
+  string,
+
+  /**
+   * The next hop is a VPN tunnel.
+   */
+  Tunnel: "Tunnel",
+
+  /**
+   * The next hop is within the local virtual network.
+   */
+  VirtualNetwork: "VirtualNetwork",
+
+  /**
+   * The next hop type could not be determined.
+   */
+  Unknown: "Unknown",
+}
+
 /**
  * Gateway Resiliency Information
  */

 using Azure.ResourceManager;
 using TypeSpec.Http;
 using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
 using Common;
 using Azure.ClientGenerator.Core;
 

 /**
  * ServiceGateway resource.
  */
-#suppress "@azure-tools/typespec-azure-core/no-private-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/no-private-usage" "ServiceGateway uses Http.Private.includeInapplicableMetadataInPayload to suppress irrelevant ARM envelope properties from the response payload, which is required for correct wire format compatibility."
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "ServiceGateway extends SecurityPerimeterTrackedResource, a shared base type defined in the Common namespace that captures the standard NSP-linked tracked resource shape. Refactoring to a standard ARM resource would require breaking changes to the existing API surface."
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "ServiceGateway inherits from SecurityPerimeterTrackedResource to share common NSP envelope properties (identity, kind, etag) across all security perimeter resource types. Composition would duplicate these definitions across the codebase."
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "ServiceGateway uses Azure.ResourceManager.Legacy.feature gating to align with the NSP feature flag pattern used across all perimeter-linked resources in this namespace."
 @Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
 @Http.Private.includeInapplicableMetadataInPayload(false)
 model ServiceGateway extends SecurityPerimeterTrackedResource {

   /** A list of availability zones denoting the zone in which service gateway should be deployed.
    *
    * - The zone values must be provided as strings representing numeric identifiers like "1", "2", "3" etc. */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "The zones property is a top-level envelope field required for availability zone deployment configuration. It is consistent with the existing pattern used by other zonal resources in this namespace (e.g. NatGateway, PublicIPAddress) and must remain in the envelope for backward compatibility."
   zones?: string[];
 }
 
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@doc("Empty success response.")
+model ServiceGatewayActionOkResponseBody {
+  /** The status of the operation. */
+  @visibility(Lifecycle.Read)
+  status?: string;
+}
+
+/** Status-only success response for synchronous service gateway update actions. */
+model ServiceGatewayActionOkResponse {
+  /** HTTP status code for successful request processing. */
+  @statusCode
+  statusCode: 200;
+
+  /** Empty response body for successful synchronous service gateway update actions. */
+  @body
+  body: ServiceGatewayActionOkResponseBody;
+}
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "ServiceGateways interface uses Azure.ResourceManager.Legacy.feature gating to conditionally expose operations only when the serviceGateway feature flag is enabled, consistent with the feature-gating pattern used across all NSP-linked resource operations in this namespace."
 @Azure.ResourceManager.Legacy.feature(Features.serviceGateway)
 @armResourceOperations
 interface ServiceGateways {

    *
    * For address-level partial updates, if no services are provided, the existing services will be considered for deletion.
    */
-  updateAddressLocations is ArmResourceActionAsync<
+  @removed(Versions.v2025_09_01)
+  @action("updateAddressLocations")
+  @sharedRoute
+  updateAddressLocationsLro is ArmResourceActionAsync<
     ServiceGateway,
     ServiceGatewayUpdateAddressLocationsRequest,
     NoContentResponse,

     Error = CloudError
   >;
 
+  /**
+   * Creates or updates address locations within the service gateway.
+   *
+   * The request supports both full and partial update modes at two levels: location and address.
+   *
+   * Full update replaces all existing data.
+   *
+   * Partial update modifies only the specified entries:
+   *
+   * For location-level partial updates, if no address is provided, the existing address will be deleted.
+   *
+   * For address-level partial updates, if no services are provided, the existing services will be considered for deletion.
+   */
+  @added(Versions.v2025_09_01)
+  @sharedRoute
+  updateAddressLocations is ArmResourceActionSync<
+    ServiceGateway,
+    ServiceGatewayUpdateAddressLocationsRequest,
+    ServiceGatewayActionOkResponse,
+    Error = CloudError
+  >;
+
   /**
    * Creates, updates, or deletes services within the service gateway.
    * The request supports both full and partial update modes at the service level.

    * Full update replaces all existing services with the new list provided in the request.
    * Partial update modifies only the specified services.
    */
-  updateServices is ArmResourceActionAsync<
+  @removed(Versions.v2025_09_01)
+  @action("updateServices")
+  @sharedRoute
+  updateServicesLro is ArmResourceActionAsync<
     ServiceGateway,
     ServiceGatewayUpdateServicesRequest,
     NoContentResponse,

     Error = CloudError
   >;
 
+  /**
+   * Creates, updates, or deletes services within the service gateway.
+   * The request supports both full and partial update modes at the service level.
+   *
+   * Full update replaces all existing services with the new list provided in the request.
+   * Partial update modifies only the specified services.
+   */
+  @added(Versions.v2025_09_01)
+  @sharedRoute
+  updateServices is ArmResourceActionSync<
+    ServiceGateway,
+    ServiceGatewayUpdateServicesRequest,
+    ServiceGatewayActionOkResponse,
+    Error = CloudError
+  >;
+
   /**
    * Get address locations in service gateway.
    */

 import "./VirtualNetworkAppliance.tsp";
 import "./ServiceGateway.tsp";
 import "./InterconnectGroup.tsp";
+import "./FirstPartyServiceTag.tsp";
+import "./AddressPrefixSet.tsp";
 import "../Common/main.tsp";
 
 using TypeSpec.Rest;

+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/rest";
+import "@typespec/versioning";
+import "./models.tsp";
+import "./ApplicationSecurityGroup.tsp";
+import "../Common/ApplicationSecurityGroup.tsp";
+
+using TypeSpec.Rest;
+using Azure.ResourceManager;
+using TypeSpec.Http;
+using TypeSpec.Versioning;
+using Common;
+
+namespace Microsoft.Network;
+
+/**
+ * Address prefix set child resource of an application security group.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Legacy feature decorator required for Network RP feature gating, consistent with other Network RP interface definitions"
+#suppress "@azure-tools/typespec-azure-core/no-private-usage" "Required for includeInapplicableMetadataInPayload which suppresses systemData in the response payload, consistent with other Network RP nested resources"
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "AddressPrefixSet uses the local Network RP ProxyResource base type consistent with other Network RP nested resources (e.g. ConnectionPolicy)"
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "Extending the local Network RP ProxyResource is the established pattern for nested resources in this RP"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+@parentResource(ApplicationSecurityGroup)
+@Http.Private.includeInapplicableMetadataInPayload(false)
+model AddressPrefixSet extends ProxyResource {
+  /** Properties of the address prefix set. */
+  properties?: AddressPrefixSetPropertiesFormat;
+
+  /** The name of the address prefix set. */
+  @visibility(Lifecycle.Read)
+  @path
+  @key("addressPrefixSetName")
+  @segment("addressPrefixSets")
+  @pattern("^[a-zA-Z0-9]([a-zA-Z0-9_.-]{0,78}[a-zA-Z0-9_])?$")
+  name: string;
+}
+
+/**
+ * Properties of address prefix set.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Uses legacy ARM resource patterns consistent with other Network RP property models"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+model AddressPrefixSetPropertiesFormat {
+  /** The list of address prefixes in CIDR notation. Supports both IPv4 and IPv6 CIDR notation (e.g. '10.0.0.0/16', '2001:db8::/32'). */
+  @minItems(1)
+  addressPrefixes: string[];
+
+  /** The provisioning state of the address prefix set resource. */
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
+}
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Uses legacy ARM resource patterns consistent with other Network RP operation interfaces"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
+@armResourceOperations(#{ omitTags: true })
+interface AddressPrefixSets {
+  /**
+   * Gets the specified address prefix set.
+   */
+  @tag("AddressPrefixSets")
+  get is ArmResourceRead<AddressPrefixSet, Error = CloudError>;
+
+  /**
+   * Creates or updates an address prefix set.
+   */
+  @tag("AddressPrefixSets")
+  createOrUpdate is ArmResourceCreateOrReplaceAsync<
+    AddressPrefixSet,
+    Error = CloudError
+  >;
+
+  /**
+   * Deletes the specified address prefix set.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-delete-operation-response-codes" "Network RP delete operations use 202+204 pattern without 200, matching existing ASG and other resource delete conventions"
+  @tag("AddressPrefixSets")
+  delete is ArmResourceDeleteWithoutOkAsync<
+    AddressPrefixSet,
+    Response = ArmDeleteAcceptedLroResponse | ArmDeletedNoContentResponse,
+    Error = CloudError
+  >;
+
+  /**
+   * Gets all address prefix sets in an application security group.
+   */
+  @tag("AddressPrefixSets")
+  list is ArmResourceListByParent<AddressPrefixSet, Error = CloudError>;
+}
+
+@@doc(AddressPrefixSet.name, "The name of the address prefix set.");
+@@doc(AddressPrefixSet.properties, "Properties of the address prefix set.");
+@@doc(
+  AddressPrefixSets.createOrUpdate::parameters.resource,
+  "Parameters supplied to the create or update address prefix set operation."
+);

+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/openapi";
+import "@typespec/rest";
+import "./models.tsp";
+import "../Common/main.tsp";
+
+using TypeSpec.Rest;
+using Azure.ResourceManager;
+using TypeSpec.Http;
+using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
+using Common;
+using Azure.ClientGenerator.Core;
+
+namespace Microsoft.Network;
+
+/**
+ * First party service tag resource.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-private-usage" "Follows the shared Network Common.Resource pattern used by every resource in this converted project"
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "Network resources extend the shared Common.Resource custom resource for backward compatibility with the existing swagger hierarchy"
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "Back compatibility with the previous Network AutoRest C# hierarchy"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Legacy.feature decorator is required for swagger file splitting in this converted project"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.firstPartyServiceTag)
+@Http.Private.includeInapplicableMetadataInPayload(false)
+model FirstPartyServiceTag extends Common.Resource {
+  /**
+   * Properties of the first party service tag.
+   */
+  properties?: FirstPartyServiceTagPropertiesFormat;
+
+  /**
+   * The unique identifier of the resource.
+   */
+  @visibility(Lifecycle.Read)
+  id?: string;
+
+  /**
+   * The type of the resource.
+   */
+  @visibility(Lifecycle.Read)
+  type?: string;
+
+  /**
+   * The name of the first party service tag.
+   */
+  @visibility(Lifecycle.Read)
+  @path
+  @key("firstPartyServiceTagName")
+  @segment("firstPartyServiceTags")
+  @maxLength(80)
+  @pattern("^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,79}$")
+  name: string;
+
+  /** A unique read-only string that changes whenever the resource is updated. */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "Etag is a standard read-only envelope property across all Network resources for backward compatibility"
+  @visibility(Lifecycle.Read)
+  etag?: string;
+}
+
+/**
+ * Properties of the first party service tag.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "Legacy.feature decorator is required for swagger file splitting in this converted project"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.firstPartyServiceTag)
+model FirstPartyServiceTagPropertiesFormat {
+  /**
+   * The value of the first party service tag.
+   */
+  value: string;
+
+  /**
+   * The reason for failure, if any.
+   */
+  @visibility(Lifecycle.Read)
+  failedReason?: string;
+
+  /**
+   * The resource GUID property of the first party service tag resource.
+   */
+  @visibility(Lifecycle.Read)
+  resourceGuid?: string;
+
+  /**
+   * The provisioning state of the first party service tag resource.
+   */
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
+}
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FirstPartyServiceTags interface uses Azure.ResourceManager.Legacy features for backward compatibility with existing swagger API"
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.firstPartyServiceTag)
+@armResourceOperations
+interface FirstPartyServiceTags {
+  /**
+   * Gets the specified first party service tag.
+   */
+  get is ArmResourceRead<FirstPartyServiceTag, Error = CloudError>;
+
+  /**
+   * Creates or updates a first party service tag.
+   */
+  createOrUpdate is ArmResourceCreateOrReplaceAsync<
+    FirstPartyServiceTag,
+    Error = CloudError
+  >;
+
+  /**
+   * Updates a first party service tag tags.
+   */
+  @patch(#{ implicitOptionality: false })
+  updateTags is ArmCustomPatchAsync<
+    FirstPartyServiceTag,
+    PatchModel = TagsObject,
+    Error = CloudError
+  >;
+
+  /**
+   * Deletes the specified first party service tag.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-delete-operation-response-codes" "Matching existing Network resource pattern (VirtualNetwork, LoadBalancer, etc.) that supports both sync (200) and async (202) delete"
+  delete is ArmResourceDeleteWithoutOkAsync<
+    FirstPartyServiceTag,
+    Response =
+      | ArmDeletedResponse
+      | ArmDeleteAcceptedLroResponse
+      | ArmDeletedNoContentResponse,
+    Error = CloudError
+  >;
+
+  /**
+   * Gets all the first party service tags in a resource group.
+   */
+  list is ArmResourceListByParent<FirstPartyServiceTag, Error = CloudError>;
+
+  /**
+   * Gets all the first party service tags in a subscription.
+   */
+  listAll is ArmListBySubscription<FirstPartyServiceTag, Error = CloudError>;
+}
+
+@@doc(FirstPartyServiceTag.name, "The name of the first party service tag.");
+@@doc(
+  FirstPartyServiceTag.properties,
+  "Properties of the first party service tag."
+);
+@@doc(
+  FirstPartyServiceTags.createOrUpdate::parameters.resource,
+  "Parameters supplied to the create or update first party service tag operation."
+);
+@@doc(
+  FirstPartyServiceTags.updateTags::parameters.properties,
+  "Parameters supplied to update first party service tag tags."
+);
+@@clientName(
+  FirstPartyServiceTags.createOrUpdate::parameters.resource,
+  "parameters"
+);
+@@clientName(
+  FirstPartyServiceTags.updateTags::parameters.properties,
+  "parameters"
+);

   ScrubbingRuleEntryState,
   "scrubbingRuleEntryState"
 );
+@@Azure.ClientGenerator.Core.clientName(
+  Microsoft.Network.ConnectionAnalyzerEndpointTypes.EndpointType,
+  "ConnectionAnalyzerEndpointType"
+);
 
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @@Legacy.flattenProperty(ApplicationGatewayIPConfiguration.properties);

 
 // This empty namespace is the merged SDK client target used by later client
 // customizations such as @@clientName and @@clientLocation.
-#suppress "@azure-tools/typespec-client-generator-core/inconsistent-multiple-service-dependency" "temporarily suppressing"
+#suppress "@azure-tools/typespec-client-generator-core/inconsistent-multiple-service-dependency" "CombineClient intentionally merges the Microsoft.Network and Microsoft.Compute (VMSS) services into a single SDK client surface via autoMergeService; the resulting multiple-service dependency is by design for this combined client target."
 @client({
   name: "CombineClient",
   service: [Microsoft.Network, Microsoft.Compute],

   ServiceGateways.updateTags::parameters.properties,
   "Parameters supplied to update service gateway tags."
 );
+#suppress "@azure-tools/typespec-azure-core/no-openapi" "The LRO variant uses a different TypeSpec member name to enable versioning, but must preserve the original operationId for wire backward compatibility with 2025-05-01 and 2025-07-01."
+@@operationId(
+  ServiceGateways.updateAddressLocationsLro,
+  "ServiceGateways_UpdateAddressLocations"
+);
+#suppress "@azure-tools/typespec-azure-core/no-openapi" "The LRO variant uses a different TypeSpec member name to enable versioning, but must preserve the original operationId for wire backward compatibility with 2025-05-01 and 2025-07-01."
+@@operationId(
+  ServiceGateways.updateServicesLro,
+  "ServiceGateways_UpdateServices"
+);
+@@doc(
+  ServiceGateways.updateAddressLocationsLro::parameters.body,
+  "Parameters supplied to create or update address locations in service gateway operation."
+);
 @@doc(
   ServiceGateways.updateAddressLocations::parameters.body,
-  "Parameters supplied to the create or updates address locations in service gateway operation."
+  "Parameters supplied to create or update address locations in service gateway operation."
+);
+@@doc(
+  ServiceGateways.updateServicesLro::parameters.body,
+  "Parameters supplied to create or update services in service gateway operation."
 );
 @@doc(
   ServiceGateways.updateServices::parameters.body,
-  "Parameters supplied to the create or updates services in service gateway operation."
+  "Parameters supplied to create or update services in service gateway operation."
 );
 @@clientName(ServiceGateways.createOrUpdate::parameters.resource, "parameters");
 @@clientName(ServiceGateways.updateTags::parameters.properties, "parameters");
+@@clientName(
+  ServiceGateways.updateAddressLocationsLro::parameters.body,
+  "parameters"
+);
 @@clientName(
   ServiceGateways.updateAddressLocations::parameters.body,
   "parameters"
 );
+@@clientName(ServiceGateways.updateServicesLro::parameters.body, "parameters");
 @@clientName(ServiceGateways.updateServices::parameters.body, "parameters");

 using Azure.ResourceManager;
 using TypeSpec.Http;
 using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
 using Common;
 
 namespace Microsoft.Network;

     NetworkVirtualApplianceInstanceId,
     Error = CloudError
   >;
+
+  /**
+   * Prepares the migration of the specified Network Virtual Appliance. This is the first step of a migration workflow, such as migrating to a new OS version or to the new internal load balancer architecture.
+   */
+  @added(Versions.v2025_09_01)
+  prepareMigration is ArmResourceActionAsyncBase<
+    NetworkVirtualAppliance,
+    Request = NetworkVirtualAppliancePrepareMigrationRequest,
+    Response =
+      | ArmAcceptedLroResponse
+      | ArmNoContentResponse<"Action completed successfully.">,
+    BaseParameters = Azure.ResourceManager.Foundations.DefaultBaseParameters<NetworkVirtualAppliance>,
+    Error = CloudError
+  >;
+
+  /**
+   * Executes the migration of the specified Network Virtual Appliance. This step performs the migration workflow that was previously prepared.
+   */
+  @added(Versions.v2025_09_01)
+  executeMigration is ArmResourceActionAsyncBase<
+    NetworkVirtualAppliance,
+    Request = NetworkVirtualApplianceExecuteMigrationRequest,
+    Response =
+      | ArmAcceptedLroResponse
+      | ArmNoContentResponse<"Action completed successfully.">,
+    BaseParameters = Azure.ResourceManager.Foundations.DefaultBaseParameters<NetworkVirtualAppliance>,
+    Error = CloudError
+  >;
+
+  /**
+   * Commits the migration of the specified Network Virtual Appliance. This finalizes a previously executed migration workflow.
+   */
+  @added(Versions.v2025_09_01)
+  commitMigration is ArmResourceActionAsyncBase<
+    NetworkVirtualAppliance,
+    Request = NetworkVirtualApplianceCommitMigrationRequest,
+    Response =
+      | ArmAcceptedLroResponse
+      | ArmNoContentResponse<"Action completed successfully.">,
+    BaseParameters = Azure.ResourceManager.Foundations.DefaultBaseParameters<NetworkVirtualAppliance>,
+    Error = CloudError
+  >;
+
+  /**
+   * Aborts an in-progress migration of the specified Network Virtual Appliance and rolls back to the previous state.
+   */
+  @added(Versions.v2025_09_01)
+  abortMigration is ArmResourceActionAsyncBase<
+    NetworkVirtualAppliance,
+    Request = void,
+    Response =
+      | ArmAcceptedLroResponse
+      | ArmNoContentResponse<"Action completed successfully.">,
+    BaseParameters = Azure.ResourceManager.Foundations.DefaultBaseParameters<NetworkVirtualAppliance>,
+    Error = CloudError
+  >;
 }
 
 @@doc(NetworkVirtualAppliance.name, "The name of Network Virtual Appliance.");

   NetworkVirtualAppliances.getBootDiagnosticLogs::parameters.body,
   "Parameters supplied to retrieve boot diagnostic logs for a NVA VM instance"
 );
+@@doc(
+  NetworkVirtualAppliances.prepareMigration::parameters.body,
+  "Parameters supplied to prepare the migration of the Network Virtual Appliance."
+);
+@@doc(
+  NetworkVirtualAppliances.executeMigration::parameters.body,
+  "Parameters supplied to execute the migration of the Network Virtual Appliance."
+);
+@@doc(
+  NetworkVirtualAppliances.commitMigration::parameters.body,
+  "Parameters supplied to commit the migration of the Network Virtual Appliance."
+);
 @@doc(
   NetworkVirtualApplianceConnections.networkVirtualApplianceConnectionsCreateOrUpdate::parameters.body,
   "Parameters supplied in an NetworkVirtualApplianceConnection PUT operation."

 import "./ExpressRoutePortsLocation.tsp";
 import "./ExpressRoutePort.tsp";
 import "./ExpressRoutePortAuthorization.tsp";
+import "./ExpressRouteLag.tsp";
 import "./FirewallPolicy.tsp";
 import "./FirewallPolicyRuleCollectionGroup.tsp";
+import "./FirewallPolicyKubeSelectorGroup.tsp";
 import "./SignaturesOverrides.tsp";
 import "./FirewallPolicyDraft.tsp";
 import "./FirewallPolicyRuleCollectionGroupDraft.tsp";

   QinQ: "QinQ",
 }
 
+/**
+ * Encapsulation method on LAG.
+ */
+@added(Versions.v2025_09_01)
+union ExpressRouteLagEncapsulation {
+  string,
+
+  /**
+   * IEEE 802.1Q encapsulation.
+   */
+  Dot1Q: "Dot1Q",
+
+  /**
+   * IEEE 802.1ad encapsulation.
+   */
+  QinQ: "QinQ",
+}
+
+/**
+ * The billing type of the ExpressRouteLag resource.
+ */
+@added(Versions.v2025_09_01)
+union ExpressRouteLagBillingType {
+  string,
+
+  /**
+   * Metered data transfer billing.
+   */
+  MeteredData: "MeteredData",
+
+  /**
+   * Unlimited data transfer billing.
+   */
+  UnlimitedData: "UnlimitedData",
+}
+
+/**
+ * LACP timer configuration.
+ */
+@added(Versions.v2025_09_01)
+union ExpressRouteLagLacpTimer {
+  string,
+
+  /**
+   * Fast LACP timer (30 seconds).
+   */
+  Fast: "Fast",
+
+  /**
+   * Slow LACP timer (90 seconds).
+   */
+  Slow: "Slow",
+}
+
 /**
  * Physical fiber port type.
  */

 }
 
 /**
- * Firewall Policy definition.
+ * Parameters for updating ExpressRouteLag tags or identity.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyPropertiesFormat {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@added(Versions.v2025_09_01)
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@summary("ExpressRouteLag Update Tags or Identity Request")
+model ExpressRouteLagUpdateTagsOrIdentityRequest {
   /**
-   * A read-only string that represents the size of the FirewallPolicyPropertiesFormat in MB. (ex 0.5MB)
+   * The identity of ExpressRouteLag, if configured.
    */
-  @visibility(Lifecycle.Read)
-  size?: string;
+  identity?: Common.ManagedServiceIdentity;
 
-  /**
-   * List of references to FirewallPolicyRuleCollectionGroups.
-   */
-  @visibility(Lifecycle.Read)
-  ruleCollectionGroups?: SubResource[];
+  ...TagsObject;
+}
 
+/**
+ * Properties specific to ExpressRouteLag resources.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@summary("ExpressRouteLag Resource Properties")
+@added(Versions.v2025_09_01)
+model ExpressRouteLagPropertiesFormat {
   /**
-   * The provisioning state of the firewall policy resource.
+   * The name of the peering location that the ExpressRouteLag is mapped to physically.
    */
-  @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  peeringLocation?: string;
 
   /**
-   * The parent firewall policy from which rules are inherited.
+   * Bandwidth of procured LAG in Gbps.
    */
-  basePolicy?: SubResource;
+  bandwidthInGbps?: int32;
 
   /**
-   * List of references to Azure Firewalls that this Firewall Policy is associated with.
+   * Aggregate Gbps of associated circuit bandwidths.
    */
   @visibility(Lifecycle.Read)
-  firewalls?: SubResource[];
+  provisionedBandwidthInGbps?: float64;
 
   /**
-   * List of references to Child Firewall Policies.
+   * Maximum transmission unit of the LAG.
    */
   @visibility(Lifecycle.Read)
-  childPolicies?: SubResource[];
+  mtu?: string;
 
   /**
-   * The operation mode for Threat Intelligence.
+   * Encapsulation method on LAG.
    */
-  threatIntelMode?: AzureFirewallThreatIntelMode;
+  encapsulation?: ExpressRouteLagEncapsulation;
 
   /**
-   * ThreatIntel Whitelist for Firewall Policy.
+   * Ether type of the LAG.
    */
-  threatIntelWhitelist?: FirewallPolicyThreatIntelWhitelist;
+  @visibility(Lifecycle.Read)
+  etherType?: string;
 
   /**
-   * Insights on Firewall Policy.
+   * The set of links of the ExpressRouteLag resource.
    */
-  insights?: FirewallPolicyInsights;
+  @summary("ExpressRouteLagLink Sub-Resources")
+  links?: ExpressRouteLagLink[];
 
   /**
-   * The private IP addresses/IP ranges to which traffic will not be SNAT.
+   * The date and time when the ExpressRouteLag was allocated.
    */
-  snat?: FirewallPolicySnat;
+  #suppress "@azure-tools/typespec-azure-core/no-string-datetime" "Backend emits allocationDate as a non-ISO 8601 formatted string (e.g. '6/16/2026 5:28:06 PM'); the property is preserved as string to maintain wire compatibility with the existing ExpressRouteLag service contract."
+  @visibility(Lifecycle.Read)
+  allocationDate?: string;
 
   /**
-   * SQL Settings definition.
+   * The provisioning state of the express route LAG resource.
    */
-  sql?: FirewallPolicySQL;
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 
   /**
-   * DNS Proxy Settings definition.
+   * The resource GUID property of the express route LAG resource.
    */
-  dnsSettings?: DnsSettings;
+  @visibility(Lifecycle.Read)
+  resourceGuid?: string;
 
   /**
-   * Explicit Proxy Settings definition.
+   * The billing type of the ExpressRouteLag resource.
    */
-  explicitProxy?: ExplicitProxy;
+  billingType?: ExpressRouteLagBillingType;
 
   /**
-   * The configuration for Intrusion detection.
+   * Number of ports in the LAG.
    */
-  intrusionDetection?: FirewallPolicyIntrusionDetection;
+  @minValue(1)
+  numberOfPorts?: int32;
 
   /**
-   * TLS Configuration definition.
+   * Minimum number of active ports required for LAG.
    */
-  transportSecurity?: FirewallPolicyTransportSecurity;
+  @minValue(1)
+  minimumActivePortsRequired?: int32;
 
   /**
-   * The Firewall Policy SKU.
+   * LACP timer configuration.
    */
-  sku?: FirewallPolicySku;
+  lacpTimer?: ExpressRouteLagLacpTimer;
 }
 
 /**
- * ThreatIntel Whitelist for Firewall Policy.
+ * ExpressRouteLagLink child resource definition.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyThreatIntelWhitelist {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "This child resource uses composition with properties object to maintain consistency with existing Network RP sub-resource modeling patterns."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@summary("ExpressRouteLagLink")
+@added(Versions.v2025_09_01)
+model ExpressRouteLagLink extends SubResource {
   /**
-   * List of IP addresses for the ThreatIntel Whitelist.
+   * ExpressRouteLagLink properties.
    */
-  ipAddresses?: string[];
+  properties?: ExpressRouteLagLinkPropertiesFormat;
 
-  /**
-   * List of FQDNs for the ThreatIntel Whitelist.
-   */
-  fqdns?: string[];
-}
+  /** The unique identifier of the resource. */
+  @visibility(Lifecycle.Read)
+  id: string;
 
-/**
- * Firewall Policy Insights.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyInsights {
-  /**
-   * A flag to indicate if the insights are enabled on the policy.
-   */
-  isEnabled?: boolean;
+  /** The type of the resource. */
+  @visibility(Lifecycle.Read)
+  type: string;
 
   /**
-   * Number of days the insights should be enabled on the policy.
+   * Name of child link resource that is unique among child link resources of the parent.
    */
-  retentionDays?: int32;
+  @visibility(Lifecycle.Read)
+  name: string;
 
   /**
-   * Workspaces needed to configure the Firewall Policy Insights.
+   * A unique read-only string that changes whenever the resource is updated.
    */
-  logAnalyticsResources?: FirewallPolicyLogAnalyticsResources;
+  @visibility(Lifecycle.Read)
+  etag?: string;
 }
 
 /**
- * Log Analytics Resources for Firewall Policy Insights.
+ * Properties specific to ExpressRouteLagLink resources.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyLogAnalyticsResources {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@summary("ExpressRouteLagLink Resource Properties")
+@added(Versions.v2025_09_01)
+model ExpressRouteLagLinkPropertiesFormat {
   /**
-   * List of workspaces for Firewall Policy Insights.
+   * Name of Azure router associated with link.
    */
-  @identifiers(#[])
-  workspaces?: FirewallPolicyLogAnalyticsWorkspace[];
+  @visibility(Lifecycle.Read)
+  routerName?: string;
 
   /**
-   * The default workspace Id for Firewall Policy Insights.
+   * Name of Azure router interface.
    */
-  defaultWorkspaceId?: SubResource;
-}
+  @visibility(Lifecycle.Read)
+  interfaceName?: string;
 
-/**
- * Log Analytics Workspace for Firewall Policy Insights.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyLogAnalyticsWorkspace {
   /**
-   * Region to configure the Workspace.
+   * Administrative state of the link.
    */
-  region?: string;
+  adminState?: ExpressRouteLinkAdminState;
 
   /**
-   * The workspace Id for Firewall Policy Insights.
+   * The provisioning state of the express route LAG link resource.
    */
-  workspaceId?: SubResource;
-}
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 
-/**
- * The private IP addresses/IP ranges to which traffic will not be SNAT.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicySnat {
   /**
-   * List of private IP addresses/IP address ranges to not be SNAT.
+   * MacSec configuration.
    */
-  privateRanges?: string[];
+  macSecConfig?: ExpressRouteLinkMacSecConfig;
 
   /**
-   * The operation mode for automatically learning private ranges to not be SNAT
+   * The set of members of the ExpressRouteLagLink resource.
    */
-  autoLearnPrivateRanges?: AutoLearnPrivateRangesMode;
+  @summary("ExpressRouteLagMember Sub-Resources")
+  members?: ExpressRouteLagMember[];
 }
 
 /**
- * SQL Settings in Firewall Policy.
+ * ExpressRouteLagMember child resource definition.
  */
-#suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicySQL {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "This child resource uses composition with properties object to maintain consistency with existing Network RP sub-resource modeling patterns."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@summary("ExpressRouteLagMember")
+@added(Versions.v2025_09_01)
+model ExpressRouteLagMember extends SubResource {
   /**
-   * A flag to indicate if SQL Redirect traffic filtering is enabled. Turning on the flag requires no rule using port 11000-11999.
+   * ExpressRouteLagMember properties.
    */
-  allowSqlRedirect?: boolean;
-}
+  properties?: ExpressRouteLagMemberPropertiesFormat;
 
-/**
- * DNS Proxy Settings in Firewall Policy.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model DnsSettings {
-  /**
-   * List of Custom DNS Servers.
-   */
-  servers?: string[];
+  /** The unique identifier of the resource. */
+  @visibility(Lifecycle.Read)
+  id: string;
+
+  /** The type of the resource. */
+  @visibility(Lifecycle.Read)
+  type: string;
 
   /**
-   * Enable DNS Proxy on Firewalls attached to the Firewall Policy.
+   * Name of child member resource that is unique among child member resources of the parent.
    */
-  enableProxy?: boolean;
+  @visibility(Lifecycle.Read)
+  name: string;
 
   /**
-   * FQDNs in Network Rules are supported when set to true.
+   * A unique read-only string that changes whenever the resource is updated.
    */
-  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  requireProxyForNetworkRules?: boolean | null;
+  @visibility(Lifecycle.Read)
+  etag?: string;
 }
 
 /**
- * Explicit Proxy Settings in Firewall Policy.
+ * Properties specific to ExpressRouteLagMember resources.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model ExplicitProxy {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@summary("ExpressRouteLagMember Resource Properties")
+@added(Versions.v2025_09_01)
+model ExpressRouteLagMemberPropertiesFormat {
   /**
-   * When set to true, explicit proxy mode is enabled.
+   * Name of Azure router interface.
    */
-  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  enableExplicitProxy?: boolean | null;
+  @visibility(Lifecycle.Read)
+  interfaceName?: string;
 
   /**
-   * Port number for explicit proxy http protocol, cannot be greater than 64000.
+   * Mapping between physical port to patch panel port.
    */
-  @minValue(0)
-  @maxValue(64000)
-  httpPort?: int32;
-
-  /**
-   * Port number for explicit proxy https protocol, cannot be greater than 64000.
-   */
-  @minValue(0)
-  @maxValue(64000)
-  httpsPort?: int32;
-
-  /**
-   * When set to true, pac file port and url needs to be provided.
-   */
-  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  enablePacFile?: boolean | null;
+  @visibility(Lifecycle.Read)
+  patchPanelId?: string;
 
   /**
-   * Port number for firewall to serve PAC file.
+   * Mapping of physical patch panel to rack.
    */
-  @minValue(0)
-  @maxValue(64000)
-  pacFilePort?: int32;
+  @visibility(Lifecycle.Read)
+  rackId?: string;
 
   /**
-   * SAS URL for PAC file.
+   * Cololocation for ExpressRoute member.
    */
-  pacFile?: string;
-}
+  @visibility(Lifecycle.Read)
+  coloLocation?: string;
 
-/**
- * Configuration for intrusion detection mode and rules.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyIntrusionDetection {
   /**
-   * Intrusion detection general state. When attached to a parent policy, the firewall's effective IDPS mode is the stricter mode of the two.
+   * Physical fiber port type.
    */
-  mode?: FirewallPolicyIntrusionDetectionStateType;
+  @visibility(Lifecycle.Read)
+  connectorType?: ExpressRouteLinkConnectorType;
 
   /**
-   * IDPS profile name. When attached to a parent policy, the firewall's effective profile is the profile name of the parent policy.
+   * Administrative state of the member port.
    */
-  profile?: FirewallPolicyIntrusionDetectionProfileType;
+  adminState?: ExpressRouteLinkAdminState;
 
   /**
-   * Intrusion detection configuration properties.
+   * The provisioning state of the express route LAG member resource.
    */
-  configuration?: FirewallPolicyIntrusionDetectionConfiguration;
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 }
 
 /**
- * The operation for configuring intrusion detection.
+ * The customer name to be printed on a letter of authorization for ExpressRouteLag.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyIntrusionDetectionConfiguration {
+#suppress "@azure-tools/typespec-azure-core/casing-style" "LOA is the standard acronym for 'Letter of Authorization' and is used consistently in service operations."
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@added(Versions.v2025_09_01)
+model GenerateExpressRouteLagsLOARequest {
   /**
-   * List of specific signatures states.
+   * The customer name.
    */
-  signatureOverrides?: FirewallPolicyIntrusionDetectionSignatureSpecification[];
+  customerName: string;
 
   /**
-   * List of rules for traffic to bypass.
+   * The list of member names for which LOA should be generated.
    */
-  @identifiers(#[])
-  bypassTrafficSettings?: FirewallPolicyIntrusionDetectionBypassTrafficSpecifications[];
+  members?: string[];
+}
 
+/**
+ * Response for GenerateExpressRouteLagsLOA API service call.
+ */
+#suppress "@azure-tools/typespec-azure-core/casing-style" "LOA is the standard acronym for 'Letter of Authorization' and is used consistently in service operations."
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@added(Versions.v2025_09_01)
+model GenerateExpressRouteLagsLOAResult {
   /**
-   * IDPS Private IP address ranges are used to identify traffic direction (i.e. inbound, outbound, etc.). By default, only ranges defined by IANA RFC 1918 are considered private IP addresses. To modify default ranges, specify your Private IP address ranges with this property
+   * The content as a base64 encoded string.
    */
-  privateRanges?: string[];
+  encodedContent?: string;
 }
 
 /**
- * Intrusion detection signatures specification states.
+ * Firewall Policy definition.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyIntrusionDetectionSignatureSpecification {
+model FirewallPolicyPropertiesFormat {
   /**
-   * Signature id.
+   * A read-only string that represents the size of the FirewallPolicyPropertiesFormat in MB. (ex 0.5MB)
    */
-  id?: string;
+  @visibility(Lifecycle.Read)
+  size?: string;
 
   /**
-   * The signature state.
+   * List of references to FirewallPolicyRuleCollectionGroups.
    */
-  mode?: FirewallPolicyIntrusionDetectionStateType;
-}
+  @visibility(Lifecycle.Read)
+  ruleCollectionGroups?: SubResource[];
 
-/**
- * Intrusion detection bypass traffic specification.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyIntrusionDetectionBypassTrafficSpecifications {
   /**
-   * Name of the bypass traffic rule.
+   * List of references to FirewallPolicyKubeSelectorGroups.
    */
-  name?: string;
+  @added(Versions.v2025_09_01)
+  @visibility(Lifecycle.Read)
+  kubeSelectorGroups?: SubResource[];
 
   /**
-   * Description of the bypass traffic rule.
+   * The provisioning state of the firewall policy resource.
    */
-  description?: string;
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 
   /**
-   * The rule bypass protocol.
+   * The parent firewall policy from which rules are inherited.
    */
-  protocol?: FirewallPolicyIntrusionDetectionProtocol;
+  basePolicy?: SubResource;
 
   /**
-   * List of source IP addresses or ranges for this rule.
+   * List of references to Azure Firewalls that this Firewall Policy is associated with.
    */
-  sourceAddresses?: string[];
+  @visibility(Lifecycle.Read)
+  firewalls?: SubResource[];
 
   /**
-   * List of destination IP addresses or ranges for this rule.
+   * List of references to Child Firewall Policies.
    */
-  destinationAddresses?: string[];
+  @visibility(Lifecycle.Read)
+  childPolicies?: SubResource[];
 
   /**
-   * List of destination ports or ranges.
+   * The operation mode for Threat Intelligence.
    */
-  destinationPorts?: string[];
+  threatIntelMode?: AzureFirewallThreatIntelMode;
 
   /**
-   * List of source IpGroups for this rule.
+   * ThreatIntel Whitelist for Firewall Policy.
    */
-  sourceIpGroups?: string[];
+  threatIntelWhitelist?: FirewallPolicyThreatIntelWhitelist;
 
   /**
-   * List of destination IpGroups for this rule.
+   * Insights on Firewall Policy.
    */
-  destinationIpGroups?: string[];
-}
+  insights?: FirewallPolicyInsights;
 
-/**
- * Configuration needed to perform TLS termination & initiation.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyTransportSecurity {
   /**
-   * The CA used for intermediate CA generation.
+   * The private IP addresses/IP ranges to which traffic will not be SNAT.
    */
-  certificateAuthority?: FirewallPolicyCertificateAuthority;
-}
+  snat?: FirewallPolicySnat;
 
-/**
- * Trusted Root certificates properties for tls.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyCertificateAuthority {
   /**
-   * Secret Id of (base-64 encoded unencrypted pfx) 'Secret' or 'Certificate' object stored in KeyVault.
+   * SQL Settings definition.
    */
-  keyVaultSecretId?: string;
+  sql?: FirewallPolicySQL;
 
   /**
-   * Name of the CA certificate.
+   * DNS Proxy Settings definition.
    */
-  name?: string;
-}
+  dnsSettings?: DnsSettings;
 
-/**
- * SKU of Firewall policy.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicySku {
   /**
-   * Tier of Firewall Policy.
+   * Explicit Proxy Settings definition.
    */
-  tier?: FirewallPolicySkuTier;
-}
+  explicitProxy?: ExplicitProxy;
 
-/**
- * Properties of the rule collection group.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyRuleCollectionGroupProperties {
   /**
-   * A read-only string that represents the size of the FirewallPolicyRuleCollectionGroupProperties in MB. (ex 1.2MB)
+   * The configuration for Intrusion detection.
    */
-  @visibility(Lifecycle.Read)
-  size?: string;
+  intrusionDetection?: FirewallPolicyIntrusionDetection;
 
   /**
-   * Priority of the Firewall Policy Rule Collection Group resource.
+   * TLS Configuration definition.
    */
-  @maxValue(65000)
-  @minValue(100)
-  priority?: int32;
+  transportSecurity?: FirewallPolicyTransportSecurity;
 
   /**
-   * Group of Firewall Policy rule collections.
+   * The Firewall Policy SKU.
    */
-  @identifiers(#[])
-  ruleCollections?: FirewallPolicyRuleCollection[];
+  sku?: FirewallPolicySku;
 
   /**
-   * The provisioning state of the firewall policy rule collection group resource.
+   * Indicates that the Firewall Policy is managed by AFC (Azure Firewall for Containers). When set, the policy is treated as read-only for callers that do not supply the AFC-managed sync marker on write operations.
    */
+  @added(Versions.v2025_09_01)
   @visibility(Lifecycle.Read)
-  provisioningState?: ProvisioningState;
+  afcManaged?: boolean;
 }
 
 /**
- * Properties of the rule collection.
+ * ThreatIntel Whitelist for Firewall Policy.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-@discriminator("ruleCollectionType")
-model FirewallPolicyRuleCollection {
-  /**
-   * The type of the rule collection.
-   */
-  ruleCollectionType: FirewallPolicyRuleCollectionType;
-
+model FirewallPolicyThreatIntelWhitelist {
   /**
-   * The name of the rule collection.
+   * List of IP addresses for the ThreatIntel Whitelist.
    */
-  name?: string;
+  ipAddresses?: string[];
 
   /**
-   * Priority of the Firewall Policy Rule Collection resource.
+   * List of FQDNs for the ThreatIntel Whitelist.
    */
-  @maxValue(65000)
-  @minValue(100)
-  priority?: int32;
+  fqdns?: string[];
 }
 
 /**
- * Will describe the query to run against the IDPS signatures DB
+ * Firewall Policy Insights.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model IdpsQueryObject {
+model FirewallPolicyInsights {
   /**
-   * Contain all filters names and values
+   * A flag to indicate if the insights are enabled on the policy.
    */
-  @identifiers(#[])
-  filters?: FilterItems[];
+  isEnabled?: boolean;
 
   /**
-   * Search term in all columns
+   * Number of days the insights should be enabled on the policy.
    */
-  search?: string;
+  retentionDays?: int32;
 
   /**
-   * Column to sort response by
+   * Workspaces needed to configure the Firewall Policy Insights.
    */
-  orderBy?: OrderBy;
+  logAnalyticsResources?: FirewallPolicyLogAnalyticsResources;
+}
 
+/**
+ * Log Analytics Resources for Firewall Policy Insights.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model FirewallPolicyLogAnalyticsResources {
   /**
-   * The number of the results to return in each page
+   * List of workspaces for Firewall Policy Insights.
    */
-  @maxValue(1000)
-  @minValue(1)
-  resultsPerPage?: int32;
+  @identifiers(#[])
+  workspaces?: FirewallPolicyLogAnalyticsWorkspace[];
 
   /**
-   * The number of records matching the filter to skip
+   * The default workspace Id for Firewall Policy Insights.
    */
-  skip?: int32;
+  defaultWorkspaceId?: SubResource;
 }
 
 /**
- * Will contain the filter name and values to operate on
+ * Log Analytics Workspace for Firewall Policy Insights.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FilterItems {
+model FirewallPolicyLogAnalyticsWorkspace {
   /**
-   * The name of the field we would like to filter
+   * Region to configure the Workspace.
    */
-  field?: string;
+  region?: string;
 
   /**
-   * List of values to filter the current field by
+   * The workspace Id for Firewall Policy Insights.
    */
-  values?: string[];
+  workspaceId?: SubResource;
 }
 
 /**
- * Describes a column to sort
+ * The private IP addresses/IP ranges to which traffic will not be SNAT.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model OrderBy {
+model FirewallPolicySnat {
   /**
-   * Describes the actual column name to sort by
+   * List of private IP addresses/IP address ranges to not be SNAT.
    */
-  field?: string;
+  privateRanges?: string[];
 
   /**
-   * Describes if results should be in ascending/descending order
+   * The operation mode for automatically learning private ranges to not be SNAT
    */
-  order?: FirewallPolicyIDPSQuerySortOrder;
+  autoLearnPrivateRanges?: AutoLearnPrivateRangesMode;
 }
 
 /**
- * Query result
+ * SQL Settings in Firewall Policy.
  */
+#suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model QueryResults {
-  /**
-   * Number of total records matching the query.
-   */
-  matchingRecordsCount?: int64;
-
+model FirewallPolicySQL {
   /**
-   * Array containing the results of the query
+   * A flag to indicate if SQL Redirect traffic filtering is enabled. Turning on the flag requires no rule using port 11000-11999.
    */
-  @identifiers(#[])
-  signatures?: SingleQueryResult[];
+  allowSqlRedirect?: boolean;
 }
 
-#suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+/**
+ * DNS Proxy Settings in Firewall Policy.
+ */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model SingleQueryResult {
+model DnsSettings {
   /**
-   * The ID of the signature
+   * List of Custom DNS Servers.
    */
-  signatureId?: int32;
+  servers?: string[];
 
   /**
-   * The current mode enforced, 0 - Disabled, 1 - Alert, 2 -Deny
+   * Enable DNS Proxy on Firewalls attached to the Firewall Policy.
    */
-  mode?: FirewallPolicyIDPSSignatureMode;
+  enableProxy?: boolean;
 
   /**
-   * Describes the severity of signature: 1 - High, 2 - Medium, 3 - Low
+   * FQDNs in Network Rules are supported when set to true.
    */
-  severity?: FirewallPolicyIDPSSignatureSeverity;
+  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  requireProxyForNetworkRules?: boolean | null;
+}
 
+/**
+ * Explicit Proxy Settings in Firewall Policy.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model ExplicitProxy {
   /**
-   * Describes in which direction signature is being enforced: 0 - OutBound, 1 - InBound, 2 - Any, 3 - Internal, 4 - InternalOutbound, 5 - InternalInbound
+   * When set to true, explicit proxy mode is enabled.
    */
-  direction?: FirewallPolicyIDPSSignatureDirection;
+  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  enableExplicitProxy?: boolean | null;
 
   /**
-   * Describes the groups the signature belongs to
+   * Port number for explicit proxy http protocol, cannot be greater than 64000.
    */
-  group?: string;
+  @minValue(0)
+  @maxValue(64000)
+  httpPort?: int32;
 
   /**
-   * Describes what is the signature enforces
+   * Port number for explicit proxy https protocol, cannot be greater than 64000.
    */
-  description?: string;
+  @minValue(0)
+  @maxValue(64000)
+  httpsPort?: int32;
 
   /**
-   * Describes the protocol the signatures is being enforced in
+   * When set to true, pac file port and url needs to be provided.
    */
-  protocol?: string;
+  #suppress "@azure-tools/typespec-azure-core/no-nullable" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  enablePacFile?: boolean | null;
 
   /**
-   * Describes the list of source ports related to this signature
+   * Port number for firewall to serve PAC file.
    */
-  sourcePorts?: string[];
+  @minValue(0)
+  @maxValue(64000)
+  pacFilePort?: int32;
 
   /**
-   * Describes the list of destination ports related to this signature
+   * SAS URL for PAC file.
    */
-  destinationPorts?: string[];
+  pacFile?: string;
+}
 
+/**
+ * Configuration for intrusion detection mode and rules.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model FirewallPolicyIntrusionDetection {
   /**
-   * Describes the last updated time of the signature (provided from 3rd party vendor)
+   * Intrusion detection general state. When attached to a parent policy, the firewall's effective IDPS mode is the stricter mode of the two.
    */
-  lastUpdated?: string;
+  mode?: FirewallPolicyIntrusionDetectionStateType;
 
   /**
-   * Describes if this override is inherited from base policy or not
+   * IDPS profile name. When attached to a parent policy, the firewall's effective profile is the profile name of the parent policy.
    */
-  inheritedFromParentPolicy?: boolean;
+  profile?: FirewallPolicyIntrusionDetectionProfileType;
+
+  /**
+   * Intrusion detection configuration properties.
+   */
+  configuration?: FirewallPolicyIntrusionDetectionConfiguration;
 }
 
 /**
- * Will contain the properties of the resource (the actual signature overrides)
+ * The operation for configuring intrusion detection.
  */
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model SignaturesOverridesProperties {
+model FirewallPolicyIntrusionDetectionConfiguration {
   /**
-   * Dictionary of <string>
+   * List of specific signatures states.
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  signatures?: Record<string>;
+  signatureOverrides?: FirewallPolicyIntrusionDetectionSignatureSpecification[];
+
+  /**
+   * List of rules for traffic to bypass.
+   */
+  @identifiers(#[])
+  bypassTrafficSettings?: FirewallPolicyIntrusionDetectionBypassTrafficSpecifications[];
+
+  /**
+   * IDPS Private IP address ranges are used to identify traffic direction (i.e. inbound, outbound, etc.). By default, only ranges defined by IANA RFC 1918 are considered private IP addresses. To modify default ranges, specify your Private IP address ranges with this property
+   */
+  privateRanges?: string[];
 }
 
 /**
- * Describes the filter values possibles for a given column
+ * Intrusion detection signatures specification states.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model SignatureOverridesFilterValuesQuery {
+model FirewallPolicyIntrusionDetectionSignatureSpecification {
   /**
-   * Describes the name of the column which values will be returned
+   * Signature id.
    */
-  filterName?: string;
+  id?: string;
+
+  /**
+   * The signature state.
+   */
+  mode?: FirewallPolicyIntrusionDetectionStateType;
 }
 
 /**
- * Describes the list of all possible values for a specific filter value
+ * Intrusion detection bypass traffic specification.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model SignatureOverridesFilterValuesResponse {
+model FirewallPolicyIntrusionDetectionBypassTrafficSpecifications {
   /**
-   * Describes the possible values
+   * Name of the bypass traffic rule.
    */
-  filterValues?: string[];
+  name?: string;
+
+  /**
+   * Description of the bypass traffic rule.
+   */
+  description?: string;
+
+  /**
+   * The rule bypass protocol.
+   */
+  protocol?: FirewallPolicyIntrusionDetectionProtocol;
+
+  /**
+   * List of source IP addresses or ranges for this rule.
+   */
+  sourceAddresses?: string[];
+
+  /**
+   * List of destination IP addresses or ranges for this rule.
+   */
+  destinationAddresses?: string[];
+
+  /**
+   * List of destination ports or ranges.
+   */
+  destinationPorts?: string[];
+
+  /**
+   * List of source IpGroups for this rule.
+   */
+  sourceIpGroups?: string[];
+
+  /**
+   * List of destination IpGroups for this rule.
+   */
+  destinationIpGroups?: string[];
 }
 
 /**
- * Describes an object containing an array with a single item
+ * Configuration needed to perform TLS termination & initiation.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model SignaturesOverridesList {
+model FirewallPolicyTransportSecurity {
   /**
-   * Describes a list consisting exactly one item describing the policy's signature override status
+   * The CA used for intermediate CA generation.
    */
-  @pageItems
-  value?: SignaturesOverrides[];
+  certificateAuthority?: FirewallPolicyCertificateAuthority;
 }
 
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+/**
+ * Trusted Root certificates properties for tls.
+ */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyDraftProperties {
+model FirewallPolicyCertificateAuthority {
   /**
-   * The parent firewall policy from which rules are inherited.
+   * Secret Id of (base-64 encoded unencrypted pfx) 'Secret' or 'Certificate' object stored in KeyVault.
    */
-  basePolicy?: SubResource;
+  keyVaultSecretId?: string;
 
   /**
-   * The operation mode for Threat Intelligence.
+   * Name of the CA certificate.
    */
-  threatIntelMode?: AzureFirewallThreatIntelMode;
+  name?: string;
+}
 
+/**
+ * SKU of Firewall policy.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model FirewallPolicySku {
   /**
-   * ThreatIntel Whitelist for Firewall Policy.
+   * Tier of Firewall Policy.
    */
-  threatIntelWhitelist?: FirewallPolicyThreatIntelWhitelist;
+  tier?: FirewallPolicySkuTier;
+}
 
+/**
+ * Kubernetes Label Selector for matching labels in Kubernetes Selector Groups.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "KubeLabelSelector belongs to the firewallPolicy resource tree, which uses the ARM Legacy resource pattern; @Azure.ResourceManager.Legacy.feature is required to keep these child types consistent with the parent firewall policy."
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+@added(Versions.v2025_09_01)
+model KubeLabelSelector {
   /**
-   * Insights on Firewall Policy.
+   * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+   * map is equivalent to an element of matchExpressions, whose key field is "key", the
+   * operator is "In", and the values array contains only "value". The requirements are ANDed.
    */
-  insights?: FirewallPolicyInsights;
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "matchLabels is a pass-through, user-defined Kubernetes label map of arbitrary string key/value pairs chosen by the user and not validated or owned by the service, mirroring Kubernetes LabelSelector.matchLabels; a Record<string> is required to represent it."
+  matchLabels?: Record<string>;
 
   /**
-   * The private IP addresses/IP ranges to which traffic will not be SNAT.
+   * matchExpressions is a list of label selector requirements. The requirements are ANDed.
    */
-  snat?: FirewallPolicySnat;
+  #suppress "@azure-tools/typespec-azure-resource-manager/missing-x-ms-identifiers" "LabelSelectorExpression has no single identifying property; it mirrors the Kubernetes label selector requirement (key/operator/values), which has no unique key, so no x-ms-identifiers can be provided."
+  matchExpressions?: LabelSelectorExpression[];
+}
 
-  /**
-   * SQL Settings definition.
-   */
-  sql?: FirewallPolicySQL;
+/**
+ * operator represents a Kubernetes label selector requirement's relationship to a set of values.
+ */
+@added(Versions.v2025_09_01)
+union LabelSelectorOperator {
+  /** The label value must be in the supplied set of values. */
+  In: "In",
+
+  /** The label value must not be in the supplied set of values. */
+  NotIn: "NotIn",
+
+  /** The label key must exist, regardless of its value. */
+  Exists: "Exists",
+
+  /** The label key must not exist. */
+  DoesNotExist: "DoesNotExist",
+
+  string,
+}
 
+/**
+ * A label selector requirement is a selector that contains values, a key, and an operator that
+ * relates the key and values.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "LabelSelectorExpression belongs to the firewallPolicy resource tree, which uses the ARM Legacy resource pattern; @Azure.ResourceManager.Legacy.feature is required to keep these child types consistent with the parent firewall policy."
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+@added(Versions.v2025_09_01)
+model LabelSelectorExpression {
   /**
-   * DNS Proxy Settings definition.
+   * key is a string of 63 characters or less, and must consist of alphanumeric characters,
+   * '-', '_' or '.'.
    */
-  dnsSettings?: DnsSettings;
+  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "key here is a Kubernetes label selector key, not a secret/credential"
+  key?: string;
 
   /**
-   * Explicit Proxy Settings definition.
+   * operator represents a key's relationship to a set of values.
+   * Valid operators are In, NotIn, Exists and DoesNotExist.
    */
-  explicitProxy?: ExplicitProxy;
+  operator?: LabelSelectorOperator;
 
   /**
-   * The configuration for Intrusion detection.
+   * values is an array of string values. If the operator is In or NotIn,
+   * the values array must be non-empty. If the operator is Exists or DoesNotExist,
+   * the values array must be empty.
    */
-  intrusionDetection?: FirewallPolicyIntrusionDetection;
+  values?: string[];
 }
 
 /**
- * Properties of the rule collection group draft.
+ * Properties of the rule collection group.
  */
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
-model FirewallPolicyRuleCollectionGroupDraftProperties {
+model FirewallPolicyRuleCollectionGroupProperties {
   /**
    * A read-only string that represents the size of the FirewallPolicyRuleCollectionGroupProperties in MB. (ex 1.2MB)
    */

 model ExpressRoutePortAuthorizationListResult
   is Azure.Core.Page<ExpressRoutePortAuthorization>;
 
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@summary("ExpressRoute LAG List Result")
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@added(Versions.v2025_09_01)
+model ExpressRouteLagListResult is Azure.Core.Page<ExpressRouteLag>;
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@summary("ExpressRoute LAG Link List Result")
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@added(Versions.v2025_09_01)
+model ExpressRouteLagLinkListResult is Azure.Core.Page<ExpressRouteLagLink>;
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project uses Azure.ResourceManager.Legacy patterns for consistency with existing ExpressRoute resources."
+@summary("ExpressRoute LAG Member List Result")
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@added(Versions.v2025_09_01)
+model ExpressRouteLagMemberListResult is Azure.Core.Page<ExpressRouteLagMember>;
+
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @summary("ExpressRoutePorts Location List Result")
 @Azure.ResourceManager.Legacy.feature(Features.expressRoute)

+import "@azure-tools/typespec-azure-core";
+import "@azure-tools/typespec-azure-resource-manager";
+import "@typespec/openapi";
+import "@typespec/rest";
+import "./models.tsp";
+import "../Common/main.tsp";
+
+using TypeSpec.Rest;
+using Azure.ResourceManager;
+using TypeSpec.Http;
+using TypeSpec.OpenAPI;
+using TypeSpec.Versioning;
+using Common;
+
+namespace Microsoft.Network;
+/**
+ * ExpressRouteLag resource definition.
+ */
+#suppress "@azure-tools/typespec-azure-core/no-private-usage" "The includeInapplicableMetadataInPayload decorator is currently under Http.Private and is required to keep payload shape aligned with existing Network RP swagger output."
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "This tracked resource explicitly defines name/etag/identity envelope fields to preserve existing Network RP contract and generated OpenAPI shape for ExpressRoute LAG."
+#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "This resource extends the shared Common.Resource envelope used across Network RP to maintain consistency with existing model composition."
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The Network RP TypeSpec project currently uses Azure.ResourceManager.Legacy feature toggles and operation templates across this API surface; this file must remain consistent with that project pattern."
+@summary("ExpressRoute LAG")
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@Http.Private.includeInapplicableMetadataInPayload(false)
+@added(Versions.v2025_09_01)
+model ExpressRouteLag extends Common.Resource {
+  /** ExpressRouteLag properties. */
+  properties?: ExpressRouteLagPropertiesFormat;
+
+  /** The unique identifier of the resource. */
+  @visibility(Lifecycle.Read)
+  id?: string;
+
+  /** The type of the resource. */
+  @visibility(Lifecycle.Read)
+  type?: string;
+
+  /** The name of the resource. */
+  @visibility(Lifecycle.Read)
+  @path
+  @key("expressRouteLagName")
+  @minLength(1)
+  @maxLength(80)
+  @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+  @segment("expressRouteLags")
+  name: string;
+
+  /** A unique read-only string that changes whenever the resource is updated. */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "etag is intentionally modeled as a read-only envelope field to match existing ExpressRoute resource contracts in Network RP."
+  @visibility(Lifecycle.Read)
+  etag?: string;
+
+  /**
+   * The identity of ExpressRouteLag, if configured.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-invalid-envelope-property" "identity is intentionally exposed at the resource envelope level to align with managed identity behavior of peer ExpressRoute resources."
+  identity?: Common.ManagedServiceIdentity;
+}
+
+alias ExpressRouteLagLinkOps = Azure.ResourceManager.Legacy.RoutedOperations<
+  {
+    ...ApiVersionParameter;
+    ...SubscriptionIdParameter;
+    ...ResourceGroupParameter;
+
+    /** The name of the express route LAG. */
+    @path
+    @segment("expressRouteLags")
+    @key
+    @minLength(1)
+    @maxLength(80)
+    @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+    expressRouteLagName: string;
+  },
+  {
+    /** The name of the express route LAG link. */
+    @path
+    @segment("links")
+    @key
+    @minLength(1)
+    @maxLength(80)
+    @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+    linkName: string;
+  },
+  ResourceRoute = #{
+    route: "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteLags/{expressRouteLagName}/links/{linkName}",
+  }
+>;
+
+alias ExpressRouteLagMemberOps = Azure.ResourceManager.Legacy.RoutedOperations<
+  {
+    ...ApiVersionParameter;
+    ...SubscriptionIdParameter;
+    ...ResourceGroupParameter;
+
+    /** The name of the express route LAG. */
+    @path
+    @segment("expressRouteLags")
+    @key
+    @minLength(1)
+    @maxLength(80)
+    @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+    expressRouteLagName: string;
+
+    /** The name of the express route LAG link. */
+    @path
+    @segment("links")
+    @key
+    @minLength(1)
+    @maxLength(80)
+    @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+    linkName: string;
+  },
+  {
+    /** The name of the express route LAG member. */
+    @path
+    @segment("members")
+    @key
+    @minLength(1)
+    @maxLength(80)
+    @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+    memberName: string;
+  },
+  ResourceRoute = #{
+    route: "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteLags/{expressRouteLagName}/links/{linkName}/members/{memberName}",
+  }
+>;
+
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "The containing service namespace still relies on Azure.ResourceManager.Legacy feature flags and templates; this interface follows the same established project-level pattern."
+@Azure.ResourceManager.Legacy.feature(Features.expressRoute)
+@armResourceOperations(#{ allowStaticRoutes: true, omitTags: true })
+@added(Versions.v2025_09_01)
+interface ExpressRouteLags {
+  /**
+   * Retrieves the requested ExpressRouteLag resource.
+   */
+  @tag("ExpressRouteLags")
+  @autoRoute
+  get is ArmResourceRead<ExpressRouteLag, Error = CloudError>;
+
+  /**
+   * Creates or updates the specified ExpressRouteLag resource.
+   */
+  @tag("ExpressRouteLags")
+  @autoRoute
+  createOrUpdate is ArmResourceCreateOrReplaceAsync<
+    ExpressRouteLag,
+    Error = CloudError
+  >;
+
+  /**
+   * Update ExpressRouteLag tags or identity.
+   */
+  @tag("ExpressRouteLags")
+  @autoRoute
+  @patch(#{ implicitOptionality: false })
+  update is ArmCustomPatchSync<
+    ExpressRouteLag,
+    PatchModel = ExpressRouteLagUpdateTagsOrIdentityRequest,
+    Error = CloudError
+  >;
+
+  /**
+   * Deletes the specified ExpressRouteLag resource.
+   */
+  @tag("ExpressRouteLags")
+  @autoRoute
+  delete is ArmResourceDeleteWithoutOkAsync<
+    ExpressRouteLag,
+    Response =
+      | ArmDeleteAcceptedLroResponse<ArmCombinedLroHeaders &
+          Azure.Core.Foundations.RetryAfterHeader>
+      | ArmDeletedNoContentResponse,
+    Error = CloudError
+  >;
+
+  /**
+   * List all the ExpressRouteLag resources in the specified resource group.
+   */
+  @tag("ExpressRouteLags")
+  @autoRoute
+  listByResourceGroup is ArmResourceListByParent<
+    ExpressRouteLag,
+    Response = ExpressRouteLagListResult,
+    Error = CloudError
+  >;
+
+  /**
+   * List all the ExpressRouteLag resources in the specified subscription.
+   */
+  @tag("ExpressRouteLags")
+  @autoRoute
+  list is ArmListBySubscription<
+    ExpressRouteLag,
+    Response = ExpressRouteLagListResult,
+    Error = CloudError
+  >;
+
+  /**
+   * Generate a letter of authorization for the requested ExpressRouteLag resource.
+   */
+  @tag("ExpressRouteLags")
+  @action("generateLoa")
+  @autoRoute
+  generateLoa is ArmResourceActionSync<
+    ExpressRouteLag,
+    GenerateExpressRouteLagsLOARequest,
+    ArmResponse<GenerateExpressRouteLagsLOAResult>,
+    Error = CloudError
+  >;
+
+  /**
+   * Retrieves the specified ExpressRouteLagLink resource.
+   */
+  @tag("ExpressRouteLagLinks")
+  @get
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteLags/{expressRouteLagName}/links/{linkName}")
+  linksGet is ExpressRouteLagLinkOps.ActionSync<
+    ExpressRouteLag,
+    void,
+    Response = ArmResponse<ExpressRouteLagLink>,
+    OverrideErrorType = CloudError
+  >;
+
+  /**
+   * Retrieve the ExpressRouteLagLink sub-resources of the specified ExpressRouteLag resource.
+   */
+  @tag("ExpressRouteLagLinks")
+  @list
+  @get
+  @action("links")
+  @autoRoute
+  linksList is ArmResourceActionSync<
+    ExpressRouteLag,
+    void,
+    ArmResponse<ExpressRouteLagLinkListResult>,
+    Error = CloudError
+  >;
+
+  /**
+   * Retrieves the specified ExpressRouteLagMember resource.
+   */
+  @tag("ExpressRouteLagMembers")
+  @get
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteLags/{expressRouteLagName}/links/{linkName}/members/{memberName}")
+  membersGet is ExpressRouteLagMemberOps.ActionSync<
+    ExpressRouteLag,
+    void,
+    Response = ArmResponse<ExpressRouteLagMember>,
+    OverrideErrorType = CloudError
+  >;
+
+  /**
+   * Retrieve the ExpressRouteLagMember sub-resources of the specified ExpressRouteLagLink resource.
+   */
+  @tag("ExpressRouteLagMembers")
+  @list
+  @get
+  @route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteLags/{expressRouteLagName}/links/{linkName}/members")
+  membersList(
+    ...ApiVersionParameter,
+    ...SubscriptionIdParameter,
+    ...ResourceGroupParameter,
+
+    /** The name of the express route LAG. */
+    @path
+    @minLength(1)
+    @maxLength(80)
+    @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+    expressRouteLagName: string,
+
+    /** The name of the express route LAG link. */
+    @path
+    @minLength(1)
+    @maxLength(80)
+    @pattern("^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+    linkName: string,
+  ): ArmResponse<ExpressRouteLagMemberListResult> | CloudError;
+}
+
+@@doc(ExpressRouteLag.name, "The name of ExpressRouteLag.");
+@@doc(ExpressRouteLag.properties, "ExpressRouteLag properties.");
+@@doc(
+  ExpressRouteLags.createOrUpdate::parameters.resource,
+  "Parameters supplied to the create ExpressRouteLag operation."
+);
+@@doc(
+  ExpressRouteLags.update::parameters.properties,
+  "Parameters supplied to update ExpressRouteLag resource tags or identity."
+);
+@@doc(
+  ExpressRouteLags.generateLoa::parameters.body,
+  "Request parameters supplied to generate a letter of authorization."
+);
+
+#suppress "@azure-tools/typespec-azure-core/no-openapi" "x-ms-pageable extension is required for this manually-routed list operation; ArmResourceListByParent is not used here"
+@@extension(
+  ExpressRouteLags.membersList,
+  "x-ms-pageable",
+  #{ nextLinkName: "nextLink" }
+);

 using TypeSpec.Versioning;
 using Common;
 /**
- * APIs to manage web application firewall rules.
+ * APIs to manage Microsoft Azure network resources.
  */
 @Azure.ResourceManager.Legacy.features(Features)
 @armProviderNamespace

    */
   @useDependency(Common.Versions.v2025_07_01)
   v2025_07_01: "2025-07-01",
+
+  /**
+   * The 2025-09-01 API version.
+   */
+  @useDependency(Common.Versions.v2025_09_01)
+  v2025_09_01: "2025-09-01",
 }
 
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"

   /**
    * The 2018-10-01 API version.
    */
-  @useDependency(Common.Versions.v2025_07_01)
+  @useDependency(Common.Versions.v2025_09_01)
   v2018_10_01: "2018-10-01",
 }

    * Local
    */
   Local: "Local",
+
+  /**
+   * MultiCloud tier for cross-cloud connectivity.
+   */
+  @added(Versions.v2025_09_01)
+  MultiCloud: "MultiCloud",
 }
 
 /**

    * Deprovisioning
    */
   Deprovisioning: "Deprovisioning",
+
+  /**
+   * DeProvisioned State
+   */
+  @added(Versions.v2025_09_01)
+  DeProvisioned: "DeProvisioned",
+}
+
+/**
+ * The resiliency level of the ExpressRoute circuit.
+ */
+@added(Versions.v2025_09_01)
+union ResiliencyLevel {
+  string,
+
+  /**
+   * Standard resiliency level.
+   */
+  Standard: "Standard",
+
+  /**
+   * High resiliency level.
+   */
+  High: "High",
+
+  /**
+   * Maximum resiliency level.
+   */
+  Maximum: "Maximum",
 }
 
 /**

    * Enable response buffering.
    */
   enableResponseBuffering?: boolean;
+
+  /**
+   * Disable default server header in response.
+   */
+  @added(Versions.v2025_09_01)
+  disableDefaultServerHeaderInResponse?: boolean;
 }
 
 /**

   @visibility(Lifecycle.Read)
   stag?: int32;
 
+  /**
+   * The resiliency level of the ExpressRoute circuit.
+   */
+  @added(Versions.v2025_09_01)
+  @visibility(Lifecycle.Read)
+  resiliencyLevel?: ResiliencyLevel;
+
+  /**
+   * Account ID of customer account on partner cloud provider.
+   */
+  @added(Versions.v2025_09_01)
+  partnerAccountId?: string;
+
+  /**
+   * Activation Key from partner cloud provider.
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/secret-prop" "activationKey is not a secret value, it is a base64 encoded string used for multi-cloud circuit provisioning."
+  @added(Versions.v2025_09_01)
+  activationKey?: string;
+
   /**
    * The provisioning state of the express route circuit resource.
    */

    */
   @identifiers(#[])
   ruleCollections?: FirewallPolicyRuleCollection[];
+
+  /**
+   * The provisioning state of the firewall policy rule collection group resource.
+   */
+  @visibility(Lifecycle.Read)
+  provisioningState?: ProvisioningState;
 }
 
 /**
- * List of IpamPool
+ * Properties of the Kubernetes Selector Group.
  */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model IpamPoolList is Azure.Core.Page<IpamPool>;
-
-/**
- * Properties of IpamPool resource properties which are specific to the Pool resource.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model IpamPoolProperties {
-  #suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  description?: string;
-
-  /**
-   * String representing a friendly name for the resource.
-   */
-  displayName?: string;
-
-  /**
-   * List of IP address type for the IpamPool.
-   */
-  @visibility(Lifecycle.Read)
-  ipAddressType?: IpType[];
-
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FirewallPolicyKubeSelectorGroupProperties belongs to the firewallPolicy resource tree, which uses the ARM Legacy resource pattern; @Azure.ResourceManager.Legacy.feature is required to keep these child types consistent with the parent firewall policy."
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+@added(Versions.v2025_09_01)
+model FirewallPolicyKubeSelectorGroupProperties {
   /**
-   * String representing parent IpamPool resource name. If empty the IpamPool will be a root pool.
+   * Kubernetes Pod selector for matching pods in the Kubernetes cluster.
    */
-  parentPoolName?: string;
+  podSelector?: KubeLabelSelector;
 
   /**
-   * List of IP address prefixes of the resource.
+   * Kubernetes Namespace selector for matching namespaces in the Kubernetes cluster.
    */
-  addressPrefixes: string[];
+  namespaceSelector?: KubeLabelSelector;
 
   /**
-   * Provisioning states of a resource.
+   * The provisioning state of the firewall policy Kubernetes selector group resource.
    */
   @visibility(Lifecycle.Read)
   provisioningState?: ProvisioningState;
 }
 
 /**
- * The resource model definition for an Azure Resource Manager tracked top level resource which has 'tags' and a 'location'
+ * Properties of the rule collection.
  */
-#suppress "@azure-tools/typespec-azure-core/composition-over-inheritance" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-no-key" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-#suppress "@azure-tools/typespec-azure-resource-manager/arm-custom-resource-usage-discourage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@summary("Tracked Resource")
-@Azure.ResourceManager.Legacy.customAzureResource(#{ isAzureResource: true })
-model CommonTrackedResource extends CommonResource {
-  /**
-   * Resource tags.
-   */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read, Lifecycle.Create, Lifecycle.Update)
-  tags?: Record<string>;
-
-  /**
-   * The geo-location where the resource lives
-   */
-  @visibility(Lifecycle.Read, Lifecycle.Create)
-  location: string;
-}
-
-/**
- * Common fields that are returned in the response for all Azure Resource Manager resources
- */
-@summary("Resource")
-model CommonResource {
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+@discriminator("ruleCollectionType")
+model FirewallPolicyRuleCollection {
   /**
-   * Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
+   * The type of the rule collection.
    */
-  @visibility(Lifecycle.Read)
-  id?: Azure.Core.armResourceIdentifier;
+  ruleCollectionType: FirewallPolicyRuleCollectionType;
 
   /**
-   * The name of the resource
+   * The name of the rule collection.
    */
-  @visibility(Lifecycle.Read)
   name?: string;
 
   /**
-   * The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
-   */
-  @visibility(Lifecycle.Read)
-  type?: string;
-
-  /**
-   * Azure Resource Manager metadata containing createdBy and modifiedBy information.
-   */
-  @visibility(Lifecycle.Read)
-  systemData?: SystemData;
-}
-
-/**
- * Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
- */
-#suppress "@azure-tools/typespec-client-generator-core/csharp-model-suffix" "Name kept for backward compatibility"
-@error
-@summary("Error response")
-model CommonErrorResponse {
-  /**
-   * The error object.
+   * Priority of the Firewall Policy Rule Collection resource.
    */
-  error?: CommonErrorDetail;
+  @maxValue(65000)
+  @minValue(100)
+  priority?: int32;
 }
 
 /**
- * The error detail.
+ * Will describe the query to run against the IDPS signatures DB
  */
-model CommonErrorDetail {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model IdpsQueryObject {
   /**
-   * The error code.
+   * Contain all filters names and values
    */
-  @visibility(Lifecycle.Read)
-  code?: string;
+  @identifiers(#[])
+  filters?: FilterItems[];
 
   /**
-   * The error message.
+   * Search term in all columns
    */
-  @visibility(Lifecycle.Read)
-  message?: string;
+  search?: string;
 
   /**
-   * The error target.
+   * Column to sort response by
    */
-  @visibility(Lifecycle.Read)
-  target?: string;
+  orderBy?: OrderBy;
 
   /**
-   * The error details.
+   * The number of the results to return in each page
    */
-  @visibility(Lifecycle.Read)
-  @identifiers(#["message", "target"])
-  details?: CommonErrorDetail[];
+  @maxValue(1000)
+  @minValue(1)
+  resultsPerPage?: int32;
 
   /**
-   * The error additional info.
+   * The number of records matching the filter to skip
    */
-  @visibility(Lifecycle.Read)
-  @identifiers(#[])
-  additionalInfo?: CommonErrorAdditionalInfo[];
+  skip?: int32;
 }
 
 /**
- * The resource management error additional info.
+ * Will contain the filter name and values to operate on
  */
-model CommonErrorAdditionalInfo {
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model FilterItems {
   /**
-   * The additional info type.
+   * The name of the field we would like to filter
    */
-  @visibility(Lifecycle.Read)
-  type?: string;
+  field?: string;
 
   /**
-   * The additional info.
+   * List of values to filter the current field by
    */
-  #suppress "@azure-tools/typespec-azure-core/no-unknown" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  info?: unknown;
+  values?: string[];
 }
 
 /**
- * Represents the IpamPool update API request interface.
+ * Describes a column to sort
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model IpamPoolUpdate {
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model OrderBy {
   /**
-   * Dictionary of <string>
+   * Describes the actual column name to sort by
    */
-  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "For backward compatibility"
-  tags?: Record<string>;
+  field?: string;
 
   /**
-   * Represents the IpamPool update properties.
+   * Describes if results should be in ascending/descending order
    */
-  properties?: IpamPoolUpdateProperties;
+  order?: FirewallPolicyIDPSQuerySortOrder;
 }
 
 /**
- * Represents the IpamPool update properties.
+ * Query result
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model IpamPoolUpdateProperties {
-  #suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  description?: string;
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model QueryResults {
+  /**
+   * Number of total records matching the query.
+   */
+  matchingRecordsCount?: int64;
 
   /**
-   * String representing a friendly name for the resource.
+   * Array containing the results of the query
    */
-  displayName?: string;
+  @identifiers(#[])
+  signatures?: SingleQueryResult[];
 }
 
-/**
- * IpamPool usage information.
- */
+#suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model PoolUsage {
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model SingleQueryResult {
   /**
-   * List of IP address prefixes of the resource.
+   * The ID of the signature
    */
-  @visibility(Lifecycle.Read)
-  addressPrefixes?: string[];
+  signatureId?: int32;
 
   /**
-   * List of IpamPool that are children of this IpamPool.
+   * The current mode enforced, 0 - Disabled, 1 - Alert, 2 -Deny
    */
-  @visibility(Lifecycle.Read)
-  @identifiers(#["resourceId"])
-  childPools?: ResourceBasics[];
+  mode?: FirewallPolicyIDPSSignatureMode;
 
   /**
-   * List of assigned IP address prefixes.
+   * Describes the severity of signature: 1 - High, 2 - Medium, 3 - Low
    */
-  @visibility(Lifecycle.Read)
-  allocatedAddressPrefixes?: string[];
+  severity?: FirewallPolicyIDPSSignatureSeverity;
 
   /**
-   * List of reserved IP address prefixes. These IP addresses could be reclaimed if not assigned in the given time.
+   * Describes in which direction signature is being enforced: 0 - OutBound, 1 - InBound, 2 - Any, 3 - Internal, 4 - InternalOutbound, 5 - InternalInbound
    */
-  @visibility(Lifecycle.Read)
-  reservedAddressPrefixes?: string[];
+  direction?: FirewallPolicyIDPSSignatureDirection;
 
   /**
-   * List of available IP address prefixes.
+   * Describes the groups the signature belongs to
    */
-  @visibility(Lifecycle.Read)
-  availableAddressPrefixes?: string[];
+  group?: string;
 
   /**
-   * Total number of IP addresses managed in the IpamPool.
+   * Describes what is the signature enforces
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  totalNumberOfIPAddresses?: string;
+  description?: string;
 
   /**
-   * Total number of assigned IP addresses in the IpamPool.
+   * Describes the protocol the signatures is being enforced in
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  numberOfAllocatedIPAddresses?: string;
+  protocol?: string;
 
   /**
-   * Total number of reserved IP addresses in the IpamPool.
+   * Describes the list of source ports related to this signature
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  numberOfReservedIPAddresses?: string;
+  sourcePorts?: string[];
 
   /**
-   * Total number of available IP addresses in the IpamPool.
+   * Describes the list of destination ports related to this signature
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  numberOfAvailableIPAddresses?: string;
-}
+  destinationPorts?: string[];
 
-/**
- * Representation of basic resource information.
- */
-#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model ResourceBasics {
   /**
-   * ResourceId of the Azure resource.
+   * Describes the last updated time of the signature (provided from 3rd party vendor)
    */
-  resourceId?: Azure.Core.armResourceIdentifier;
+  lastUpdated?: string;
 
   /**
-   * List of IP address prefixes of the resource.
+   * Describes if this override is inherited from base policy or not
    */
-  addressPrefixes?: string[];
+  inheritedFromParentPolicy?: boolean;
 }
 
 /**
- * List of PoolAssociation
+ * Will contain the properties of the resource (the actual signature overrides)
  */
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model PoolAssociationList is Azure.Core.Page<PoolAssociation>;
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model SignaturesOverridesProperties {
+  /**
+   * Dictionary of <string>
+   */
+  #suppress "@azure-tools/typespec-azure-resource-manager/arm-no-record" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+  signatures?: Record<string>;
+}
 
 /**
- * IpamPool association information.
+ * Describes the filter values possibles for a given column
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-@Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model PoolAssociation {
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model SignatureOverridesFilterValuesQuery {
   /**
-   * Resource id of the associated Azure resource.
+   * Describes the name of the column which values will be returned
    */
-  resourceId: Azure.Core.armResourceIdentifier;
+  filterName?: string;
+}
 
+/**
+ * Describes the list of all possible values for a specific filter value
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model SignatureOverridesFilterValuesResponse {
   /**
-   * IpamPool id for which the resource is associated to.
+   * Describes the possible values
    */
-  poolId?: Azure.Core.armResourceIdentifier;
+  filterValues?: string[];
+}
 
-  #suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  description?: string;
+/**
+ * Describes an object containing an array with a single item
+ */
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model SignaturesOverridesList {
+  /**
+   * Describes a list consisting exactly one item describing the policy's signature override status
+   */
+  @pageItems
+  value?: SignaturesOverrides[];
+}
 
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model FirewallPolicyDraftProperties {
   /**
-   * List of assigned IP address prefixes in the IpamPool of the associated resource.
+   * The parent firewall policy from which rules are inherited.
    */
-  @visibility(Lifecycle.Read)
-  addressPrefixes?: string[];
+  basePolicy?: SubResource;
 
   /**
-   * List of reserved IP address prefixes in the IpamPool of the associated resource.
+   * The operation mode for Threat Intelligence.
    */
-  @visibility(Lifecycle.Read)
-  reservedPrefixes?: string[];
+  threatIntelMode?: AzureFirewallThreatIntelMode;
 
   /**
-   * Total number of assigned IP addresses of the association.
+   * ThreatIntel Whitelist for Firewall Policy.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  totalNumberOfIPAddresses?: string;
+  threatIntelWhitelist?: FirewallPolicyThreatIntelWhitelist;
 
   /**
-   * Total number of reserved IP addresses of the association.
+   * Insights on Firewall Policy.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  numberOfReservedIPAddresses?: string;
+  insights?: FirewallPolicyInsights;
 
   /**
-   * Creation time of the association.
+   * The private IP addresses/IP ranges to which traffic will not be SNAT.
    */
-  @visibility(Lifecycle.Read)
-  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
-  createdAt?: utcDateTime;
+  snat?: FirewallPolicySnat;
 
   /**
-   * Expire time for IP addresses reserved.
+   * SQL Settings definition.
+   */
+  sql?: FirewallPolicySQL;
+
+  /**
+   * DNS Proxy Settings definition.
+   */
+  dnsSettings?: DnsSettings;
+
+  /**
+   * Explicit Proxy Settings definition.
+   */
+  explicitProxy?: ExplicitProxy;
+
+  /**
+   * The configuration for Intrusion detection.
+   */
+  intrusionDetection?: FirewallPolicyIntrusionDetection;
+}
+
+/**
+ * Properties of the rule collection group draft.
+ */
+#suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-provisioning-state" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+#suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
+@Azure.ResourceManager.Legacy.feature(Features.firewallPolicy)
+model FirewallPolicyRuleCollectionGroupDraftProperties {
+  /**
+   * A read-only string that represents the size of the FirewallPolicyRuleCollectionGroupProperties in MB. (ex 1.2MB)
    */
   @visibility(Lifecycle.Read)
-  // FIXME: (utcDateTime) Please double check that this is the correct type for your scenario.
-  reservationExpiresAt?: utcDateTime;
+  size?: string;
+
+  /**
+   * Priority of the Firewall Policy Rule Collection Group resource.
+   */
+  @maxValue(65000)
+  @minValue(100)
+  priority?: int32;
+
+  /**
+   * Group of Firewall Policy rule collections.
+   */
+  @identifiers(#[])
+  ruleCollections?: FirewallPolicyRuleCollection[];
 }
 
 /**
- * List of StaticCidr
+ * List of IpamPool
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model StaticCidrList is Azure.Core.Page<StaticCidr>;
+model IpamPoolList is Azure.Core.Page<IpamPool>;
 
 /**
- * Properties of static CIDR resource.
+ * Properties of IpamPool resource properties which are specific to the Pool resource.
  */
 #suppress "@azure-tools/typespec-azure-core/no-legacy-usage" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
 @Azure.ResourceManager.Legacy.feature(Features.virtualNetwork)
-model StaticCidrProperties {
+model IpamPoolProperties {
   #suppress "@azure-tools/typespec-azure-core/documentation-required" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
   description?: string;
 
   /**
-   * Number of IP addresses to allocate for a static CIDR resource. The IP addresses will be assigned based on IpamPools available space.
+   * String representing a friendly name for the resource.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  numberOfIPAddressesToAllocate?: string;
+  displayName?: string;
 
   /**
-   * List of IP address prefixes of the resource.
+   * List of IP address type for the IpamPool.
    */
-  addressPrefixes?: string[];
+  @visibility(Lifecycle.Read)
+  ipAddressType?: IpType[];
 
   /**
-   * Total number of IP addresses allocated for the static CIDR resource.
+   * String representing parent IpamPool resource name. If empty the IpamPool will be a root pool.
    */
-  #suppress "@azure-tools/typespec-azure-core/casing-style" "FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details"
-  @visibility(Lifecycle.Read)
-  totalNumberOfIPAddresses?: string;
+  parentPoolName?: string;
+
+  /**
+   * List of IP address prefixes of the resource.
+   */
+  addressPrefixes: string[];
 
   /**
    * Provisioning states of a resource.