{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-azure-batch/json-schema/microsoft-azure-batch-batch-account-update-parameters-schema.json",
  "title": "BatchAccountUpdateParameters",
  "description": "Parameters for updating an Azure Batch account.",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_superseded/microsoft-azure-batch-batchaccount-api-openapi.yml#/components/schemas/BatchAccountUpdateParameters",
  "type": "object",
  "properties": {
    "tags": {
      "type": "object",
      "description": "The user-specified tags associated with the account.",
      "additionalProperties": {
        "type": "string"
      }
    },
    "properties": {
      "$ref": "#/$defs/BatchAccountUpdateProperties",
      "description": "The properties of the account.",
      "x-ms-client-flatten": true
    },
    "identity": {
      "$ref": "#/$defs/BatchAccountIdentity",
      "description": "The identity of the Batch account."
    }
  },
  "$defs": {
    "AuthenticationMode": {
      "type": "string",
      "description": "The authentication mode for the Batch account.",
      "enum": [
        "SharedKey",
        "AAD",
        "TaskAuthenticationToken"
      ],
      "x-ms-enum": {
        "name": "AuthenticationMode",
        "modelAsString": false,
        "values": [
          {
            "name": "SharedKey",
            "value": "SharedKey",
            "description": "The authentication mode using shared keys."
          },
          {
            "name": "AAD",
            "value": "AAD",
            "description": "The authentication mode using Microsoft Entra ID."
          },
          {
            "name": "TaskAuthenticationToken",
            "value": "TaskAuthenticationToken",
            "description": "The authentication mode using task authentication tokens."
          }
        ]
      }
    },
    "AutoStorageBaseProperties": {
      "type": "object",
      "description": "The properties related to the auto-storage account.",
      "properties": {
        "storageAccountId": {
          "type": "string",
          "format": "arm-id",
          "description": "The resource ID of the storage account to be used for auto-storage account.",
          "x-ms-arm-id-details": {
            "allowedResources": [
              {
                "type": "Microsoft.Storage/storageAccounts"
              }
            ]
          }
        },
        "authenticationMode": {
          "type": "string",
          "description": "The authentication mode which the Batch service will use to manage the auto-storage account.",
          "default": "StorageKeys",
          "enum": [
            "StorageKeys",
            "BatchAccountManagedIdentity"
          ],
          "x-ms-enum": {
            "name": "AutoStorageAuthenticationMode",
            "modelAsString": false,
            "values": [
              {
                "name": "StorageKeys",
                "value": "StorageKeys",
                "description": "The Batch service will authenticate requests to auto-storage using storage account keys."
              },
              {
                "name": "BatchAccountManagedIdentity",
                "value": "BatchAccountManagedIdentity",
                "description": "The Batch service will authenticate requests to auto-storage using the managed identity assigned to the Batch account."
              }
            ]
          }
        },
        "nodeIdentityReference": {
          "$ref": "#/$defs/ComputeNodeIdentityReference",
          "title": "The reference to the user assigned identity which compute nodes will use to access auto-storage.",
          "description": "The identity referenced here must be assigned to pools which have compute nodes that need access to auto-storage."
        }
      },
      "required": [
        "storageAccountId"
      ]
    },
    "BatchAccountIdentity": {
      "type": "object",
      "description": "The identity of the Batch account, if configured. This is used when the user specifies 'Microsoft.KeyVault' as their Batch account encryption configuration or when `ManagedIdentity` is selected as the auto-storage authentication mode.",
      "properties": {
        "principalId": {
          "type": "string",
          "description": "The principal id of the Batch account. This property will only be provided for a system assigned identity.",
          "readOnly": true
        },
        "tenantId": {
          "type": "string",
          "description": "The tenant id associated with the Batch account. This property will only be provided for a system assigned identity.",
          "readOnly": true
        },
        "type": {
          "$ref": "#/$defs/ResourceIdentityType",
          "description": "The type of identity used for the Batch account."
        },
        "userAssignedIdentities": {
          "type": "object",
          "description": "The list of user identities associated with the Batch account.",
          "additionalProperties": {
            "$ref": "#/$defs/UserAssignedIdentities"
          }
        }
      },
      "required": [
        "type"
      ]
    },
    "BatchAccountUpdateProperties": {
      "type": "object",
      "description": "The properties of a Batch account.",
      "properties": {
        "autoStorage": {
          "$ref": "#/$defs/AutoStorageBaseProperties",
          "description": "The properties related to the auto-storage account."
        },
        "encryption": {
          "$ref": "#/$defs/EncryptionProperties",
          "title": "The encryption configuration for the Batch account.",
          "description": "Configures how customer data is encrypted inside the Batch account. By default, accounts are encrypted using a Microsoft managed key. For additional control, a customer-managed key can be used instead."
        },
        "allowedAuthenticationModes": {
          "type": [
            "array",
            "null"
          ],
          "description": "List of allowed authentication modes for the Batch account that can be used to authenticate with the data plane. This does not affect authentication with the control plane.",
          "items": {
            "$ref": "#/$defs/AuthenticationMode"
          }
        },
        "publicNetworkAccess": {
          "type": "string",
          "title": "The network access type for accessing Azure Batch account.",
          "description": "The network access type for operating on the resources in the Batch account.",
          "default": "Enabled",
          "enum": [
            "Enabled",
            "Disabled",
            "SecuredByPerimeter"
          ],
          "x-ms-enum": {
            "name": "PublicNetworkAccessType",
            "modelAsString": false,
            "values": [
              {
                "name": "Enabled",
                "value": "Enabled",
                "description": "Enables connectivity to Azure Batch through public DNS."
              },
              {
                "name": "Disabled",
                "value": "Disabled",
                "description": "Disables public connectivity and enables private connectivity to Azure Batch Service through private endpoint resource."
              },
              {
                "name": "SecuredByPerimeter",
                "value": "SecuredByPerimeter",
                "description": "Secures connectivity to Azure Batch through NSP configuration."
              }
            ]
          }
        },
        "networkProfile": {
          "$ref": "#/$defs/NetworkProfile",
          "title": "Network profile for Batch account, which contains network rule settings for each endpoint.",
          "description": "The network profile only takes effect when publicNetworkAccess is enabled."
        }
      }
    },
    "ComputeNodeIdentityReference": {
      "type": "object",
      "description": "The reference to a user assigned identity associated with the Batch pool which a compute node will use.",
      "properties": {
        "resourceId": {
          "type": "string",
          "description": "The ARM resource id of the user assigned identity."
        }
      }
    },
    "EncryptionProperties": {
      "type": "object",
      "description": "Configures how customer data is encrypted inside the Batch account. By default, accounts are encrypted using a Microsoft managed key. For additional control, a customer-managed key can be used instead.",
      "properties": {
        "keySource": {
          "$ref": "#/$defs/KeySource",
          "description": "Type of the key source."
        },
        "keyVaultProperties": {
          "$ref": "#/$defs/KeyVaultProperties",
          "description": "Additional details when using Microsoft.KeyVault"
        }
      }
    },
    "EndpointAccessDefaultAction": {
      "type": "string",
      "description": "Default action for endpoint access. It is only applicable when publicNetworkAccess is enabled.",
      "enum": [
        "Allow",
        "Deny"
      ],
      "x-ms-enum": {
        "name": "EndpointAccessDefaultAction",
        "modelAsString": false,
        "values": [
          {
            "name": "Allow",
            "value": "Allow",
            "description": "Allow client access."
          },
          {
            "name": "Deny",
            "value": "Deny",
            "description": "Deny client access."
          }
        ]
      }
    },
    "EndpointAccessProfile": {
      "type": "object",
      "description": "Network access profile for Batch endpoint.",
      "properties": {
        "defaultAction": {
          "$ref": "#/$defs/EndpointAccessDefaultAction",
          "title": "The default action when there is no IPRule matched.",
          "description": "Default action for endpoint access. It is only applicable when publicNetworkAccess is enabled."
        },
        "ipRules": {
          "type": "array",
          "description": "Array of IP ranges to filter client IP address.",
          "items": {
            "$ref": "#/$defs/IPRule"
          },
          "x-ms-identifiers": [
            "action"
          ]
        }
      },
      "required": [
        "defaultAction"
      ]
    },
    "IPRule": {
      "type": "object",
      "description": "Rule to filter client IP address.",
      "properties": {
        "action": {
          "$ref": "#/$defs/IPRuleAction",
          "description": "Action when client IP address is matched."
        },
        "value": {
          "type": "string",
          "title": "The IP address or IP address range to filter",
          "description": "IPv4 address, or IPv4 address range in CIDR format."
        }
      },
      "required": [
        "action",
        "value"
      ]
    },
    "IPRuleAction": {
      "type": "string",
      "description": "The action when client IP address is matched.",
      "enum": [
        "Allow"
      ],
      "x-ms-enum": {
        "name": "IPRuleAction",
        "modelAsString": false,
        "values": [
          {
            "name": "Allow",
            "value": "Allow",
            "description": "Allow access for the matched client IP address."
          }
        ]
      }
    },
    "KeySource": {
      "type": "string",
      "description": "Type of the key source.",
      "enum": [
        "Microsoft.Batch",
        "Microsoft.KeyVault"
      ],
      "x-ms-enum": {
        "name": "KeySource",
        "modelAsString": false,
        "values": [
          {
            "name": "Microsoft.Batch",
            "value": "Microsoft.Batch",
            "description": "Batch creates and manages the encryption keys used to protect the account data."
          },
          {
            "name": "Microsoft.KeyVault",
            "value": "Microsoft.KeyVault",
            "description": "The encryption keys used to protect the account data are stored in an external key vault. If this is set then the Batch Account identity must be set to `SystemAssigned` and a valid Key Identifier must also be supplied under the keyVaultProperties."
          }
        ]
      }
    },
    "KeyVaultProperties": {
      "type": "object",
      "description": "KeyVault configuration when using an encryption KeySource of Microsoft.KeyVault.",
      "properties": {
        "keyIdentifier": {
          "type": "string",
          "description": "Full path to the secret with or without version. Example https://mykeyvault.vault.azure.net/keys/testkey/6e34a81fef704045975661e297a4c053. or https://mykeyvault.vault.azure.net/keys/testkey. To be usable the following prerequisites must be met:\n\nThe Batch Account has a System Assigned identity\nThe account identity has been granted Key/Get, Key/Unwrap and Key/Wrap permissions\nThe KeyVault has soft-delete and purge protection enabled"
        }
      }
    },
    "NetworkProfile": {
      "type": "object",
      "description": "Network profile for Batch account, which contains network rule settings for each endpoint.",
      "properties": {
        "accountAccess": {
          "$ref": "#/$defs/EndpointAccessProfile",
          "description": "Network access profile for batchAccount endpoint (Batch account data plane API)."
        },
        "nodeManagementAccess": {
          "$ref": "#/$defs/EndpointAccessProfile",
          "description": "Network access profile for nodeManagement endpoint (Batch service managing compute nodes for Batch pools)."
        }
      }
    },
    "ResourceIdentityType": {
      "type": "string",
      "description": "The type of identity used for the Batch account.",
      "enum": [
        "SystemAssigned",
        "UserAssigned",
        "None"
      ],
      "x-ms-enum": {
        "name": "ResourceIdentityType",
        "modelAsString": false,
        "values": [
          {
            "name": "SystemAssigned",
            "value": "SystemAssigned",
            "description": "Batch account has a system assigned identity with it."
          },
          {
            "name": "UserAssigned",
            "value": "UserAssigned",
            "description": "Batch account has user assigned identities with it."
          },
          {
            "name": "None",
            "value": "None",
            "description": "Batch account has no identity associated with it. Setting `None` in update account will remove existing identities."
          }
        ]
      }
    },
    "UserAssignedIdentities": {
      "type": "object",
      "description": "The list of associated user identities.",
      "properties": {
        "principalId": {
          "type": "string",
          "description": "The principal id of user assigned identity.",
          "readOnly": true
        },
        "clientId": {
          "type": "string",
          "description": "The client id of user assigned identity.",
          "readOnly": true
        }
      }
    }
  }
}