Allow Public IP DCP association with inherited protection

[venkatasaimaram7]

Description

Follow-up to #29925. Removes the client-side requirement that a Public IP address use DDoS protection mode Enabled before associating a DDoS custom policy.

NRP accepts DDoS custom policy association for supported Standard Public IP attachments using VirtualNetworkInherited. The service remains authoritative for SKU, attachment, policy state, subscription, and region validation.

Changes

• Remove the Enabled-only guard from Set-AzPublicIpAddress.
• Initialize DDoS settings when needed before assigning the custom policy reference.
• Update cmdlet help and changelog.
• Exercise VirtualNetworkInherited in the Public IP DCP scenario and refresh its live recording.

Testing

• Az.Network targeted build passed.
• Live TestPublicIpDdosCustomPolicy recording passed.
• Playback TestPublicIpDdosCustomPolicy passed.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution @venkatasaimaram7! We will review the pull request and get back to you soon.

[Copilot]

Pull request overview

This PR updates the Az.Network Set-AzPublicIpAddress cmdlet to allow associating a DDoS custom policy when a Public IP uses inherited DDoS protection (VirtualNetworkInherited), relying on the Network Resource Provider (NRP) to validate eligibility and constraints.

Changes:

• Removed the client-side “ProtectionMode must be Enabled” guard when setting -DdosCustomPolicyId.
• Ensured DDoS settings are initialized when needed prior to assigning the custom policy reference.
• Updated module changelog/help text and refreshed the Public IP DDoS custom policy scenario test to exercise VirtualNetworkInherited.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

File	Description
src/Network/Network/PublicIpAddress/SetAzurePublicIpAddressCommand.cs	Removes the local Enabled-only validation and initializes DdosSettings when associating a custom policy.
src/Network/Network/help/Set-AzPublicIpAddress.md	Updates example/parameter documentation to remove the prior Enabled-only requirement language.
src/Network/Network/ChangeLog.md	Adds an upcoming-release note describing the VirtualNetworkInherited association scenario.
src/Network/Network.Test/ScenarioTests/PublicIpAddressTests.ps1	Updates the DDoS custom policy scenario to create/validate a Public IP using VirtualNetworkInherited.

Suppressed comments (1)

src/Network/Network/help/Set-AzPublicIpAddress.md:151

• The -DdosCustomPolicyId parameter description removed all mention of DDoS protection mode. Since the service validates protection mode (including VirtualNetworkInherited), documenting that validation makes the behavior clearer.

The DDoS custom policy ID to associate with a supported public IP address.
The service validates whether the public IP address attachment supports a DDoS custom policy.
This parameter cannot be used with `-RemoveDdosCustomPolicy`.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/Network/Network/PublicIpAddress/SetAzurePublicIpAddressCommand.cs:70

• When associating a DDoS custom policy, the cmdlet only initializes DdosSettings when it is null. However, Get-AzPublicIpAddress always materializes DdosSettings (via AutoMapper mapping that maps null to a new DdosSettings), so ProtectionMode can still be empty and the request will send a null/empty protection mode. To align with the intended support for inherited protection, set ProtectionMode to VirtualNetworkInherited when it’s not already provided before assigning DdosCustomPolicy.

                if (this.PublicIpAddress.DdosSettings == null)
                {
                    this.PublicIpAddress.DdosSettings = new PSDdosSettings();
                }

src/Network/Network.Test/ScenarioTests/PublicIpAddressTests.ps1:816

• The updated scenario no longer asserts that the association results in VirtualNetworkInherited protection mode, so it doesn’t actually verify the PR’s intended behavior. Add an assertion for DdosSettings.ProtectionMode after attaching the custom policy to ensure the scenario exercises the inherited protection flow.

        Assert-AreEqual $expected.ResourceGroupName $actual.ResourceGroupName
        Assert-AreEqual $expected.Name $actual.Name
        Assert-AreEqual $dcp.Id $expected.DdosSettings.DdosCustomPolicy.Id

[VeryEarly]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[VeryEarly]

please sync your branch with main and update changelog.md

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/Network/Network/ChangeLog.md:25

• Changelog entry is written in present tense; this section’s entries are consistently phrased in past tense (e.g., “Added…”, “Fixed…”). Reword this bullet to past tense to match the established ChangeLog.md format.

    - DDoS custom policy association does not require a specific DDoS protection mode.