Deploying Azure Stram Analytics(ASA) SQL Input using CLI will not trigger the policy #33553

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

No response

Resource Provider

Microsoft.StreamAnalytics

Description of Feature or Work Requested

Trying to create an Azure Stream Analytics(ASA) Input via CLI command.
Related doc: https://learn.microsoft.com/en-us/cli/azure/stream-analytics/input?view=azure-cli-latest

At the same time, there is an Azure Policy that Deny the creation of any resources that are not using Managed Identity authentication mode.

When running the command, if ASA Input has 'ConnectionString' auth mode, the policy should trigger**, but that does not happen**.

Previously the same issue was resolved but for Storage Input: Azure/azure-cli-extensions#9708

Now, customer is reporting same issue with SQL Input

How to repro:

1. Saved bellow code in a file- sqlnput.json:
   (usedall3(connectionString, SqlServer, Sql Server Authentication)for authenticationMode)-all have same result
   {
   "type": "Reference",
   "datasource": {
   "type": "Microsoft.Sql/Server/Database",
   "properties": {
   "fullSnapshotQuery": "SELECT * from a",
   "refreshType": "Static",
   "refreshRate": "00:00:00",
   "server": "",
   "database": "",
   "user": "",
   "password": "",
   "authenticationMode": "SqlServer"
   }
   }
   }

2. Ran bellow command to deploy the Input:
   azstream-analyticsinputcreate --properties "@sqlInput.json"
   --input-name sqlInput-cli25 --job-name <asaJobName>
   --resource-group `
   --subscription

Ran the command in Debug mode. Result:

Enable VT mode.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x021D6CA8>, <function OutputProducer.on_global_arguments at 0x02533938>, <function CLIQuery.on_global_arguments at 0x02559B18>]
cli.azure.cli.core.util: attempting to read file sqlInput.json as utf-8-sig
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'stream-analytics': ['azext_stream_analytics']
cli.azure.cli.core: Loading command modules...
cli.azure.cli.core: Loaded command modules in parallel:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: Total (0) 0.001 0 0
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: stream-analytics 0.750 9 47 C:\Users\babogdan.azure\cliextensions\stream-analytics
cli.azure.cli.core: Total (1) 0.750 9 47
cli.azure.cli.core: Loaded 9 groups, 47 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : stream-analytics input create
cli.azure.cli.core: Command table: stream-analytics input create
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x0430C2F8>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\babogdan.azure\commands\2026-06-15.10-06-36.stream-analytics_input_create.15288.log'.
az_command_data_logger: command args: stream-analytics input create --properties {} --input-name {} --job-name {} --resource-group {} --subscription {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x0438D078>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x0438D1B8>, <function register_cache_arguments..add_cache_arguments at 0x0439F4D8>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x0439F528>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x02533988>, <function CLIQuery.handle_query_parameter at 0x02559B68>, <function register_ids_argument..parse_ids_arguments at 0x0439F438>]
az_command_data_logger: extension name: stream-analytics
az_command_data_logger: extension version: 1.0.2
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=StreamAnalyticsManagementClient
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\Users\babogdan\.azure\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\babogdan.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3
msal.authority: openid_config("https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic', 'self_signed_tls_client_auth'], 'jwks_uri': 'https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/16b3c013-d300-468d-ac64-7eda0820b6d3/kerberos', 'mtls_endpoint_aliases': {'token_endpoint': 'https://mtlsauth.microsoft.com/16b3c013-d300-468d-ac64-7eda0820b6d3/oauth2/v2.0/token'}, 'tls_client_certificate_bound_access_tokens': True, 'tenant_region_scope': 'NA', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net/'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 7cda074c-e75d-4791-8d68-20e9a0ceefc4
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/65dc4858-8a91-4496-8faf-9568b7a878d5/resourcegroups/ASA_rg/providers/Microsoft.StreamAnalytics/streamingjobs/baboasawe/inputs/sqlInput-cli256?api-version=2020-03-01'
cli.azure.cli.core.sdk.policies: Request method: 'PUT'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'Content-Length': '296'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'bf117f92-6888-11f1-ac3e-6ca10052271a'
cli.azure.cli.core.sdk.policies: 'CommandName': 'stream-analytics input create'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--properties --input-name --job-name --resource-group --subscription --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.84.0 (MSI) azsdk-python-core/1.38.0 Python/3.13.11 (Windows-11-10.0.26200-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: {"properties": {"type": "Reference", "datasource": {"type": "Microsoft.Sql/Server/Database", "properties": {"server": "babosql", "database": "baboSqlDb", "user": "database", "password": "", "refreshType": "Static", "refreshRate": "00:00:00", "fullSnapshotQuery": "SELECT * from a"}}}}
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "PUT /subscriptions/65dc4858-8a91-4496-8faf-9568b7a878d5/resourcegroups/ASA_rg/providers/Microsoft.StreamAnalytics/streamingjobs/baboasawe/inputs/sqlInput-cli256?api-version=2020-03-01 HTTP/1.1" 200 809
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-store, no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '809'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'ETag': '4012eeb0-e79d-4154-97b2-4a93b5b8260b'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'bf117f92-6888-11f1-ac3e-6ca10052271a'
cli.azure.cli.core.sdk.policies: 'x-ms-operation-identifier': 'tenantId=16b3c013-d300-468d-ac64-7eda0820b6d3,objectId=ec781fd7-d284-4e3b-a8f1-eedbbb8bb069/westeurope/45c33bc7-e445-4b0d-9790-5124f63765ec'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-writes': '199'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-writes': '2999'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'e487af6b-83e1-42d7-89ac-41eb81084292'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20260615T070634Z:e487af6b-83e1-42d7-89ac-41eb81084292'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 4A5A74B4A4C24E04B521539638B69526 Ref B: BER231070920054 Ref C: 2026-06-15T07:06:34Z'
cli.azure.cli.core.sdk.policies: 'Date': 'Mon, 15 Jun 2026 07:06:34 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {
"id": "/subscriptions/65dc4858-8a91-4496-8faf-9568b7a878d5/resourceGroups/ASA_rg/providers/Microsoft.StreamAnalytics/streamingjobs/baboasawe/inputs/sqlInput-cli256",
"name": "sqlInput-cli256",
"type": "Microsoft.StreamAnalytics/streamingjobs/inputs",
"properties": {
"type": "Reference",
"datasource": {
"type": "Microsoft.Sql/Server/Database",
"properties": {
"fullSnapshotQuery": "SELECT * from a",
"refreshType": "Static",
"refreshRate": "00:00:00",
"server": "babosql",
"database": "baboSqlDb",
"user": "database",
"authenticationMode": "ConnectionString"
}
},
"compression": {
"type": "None"
},
"schemaRegistry": null,
"messagingCatalogConfiguration": null
}
}
cli.knack.cli: Event: CommandInvoker.OnTransformResult [<function _resource_group_transform at 0x04343CF8>, <function x509_from_base64_to_hex_transform at 0x04343D48>]
cli.knack.cli: Event: CommandInvoker.OnFilterResult []
{
"id": "/subscriptions/65dc4858-8a91-4496-8faf-9568b7a878d5/resourceGroups/ASA_rg/providers/Microsoft.StreamAnalytics/streamingjobs/baboasawe/inputs/sqlInput-cli256",
"name": "sqlInput-cli256",
"properties": {
"compression": {
"type": "None"
},
"datasource": {
"database": "baboSqlDb",
"deltaSnapshotQuery": null,
"fullSnapshotQuery": "SELECT * from a",
"password": null,
"refreshRate": "00:00:00",
"refreshType": "Static",
"server": "babosql",
"table": null,
"type": "Microsoft.Sql/Server/Database",
"user": "database"
},
"diagnostics": null,
"etag": null,
"messagingCatalogConfiguration": null,
"partitionKey": null,
"schemaRegistry": null,
"serialization": null,
"type": "Reference"
},
"resourceGroup": "ASA_rg",
"type": "Microsoft.StreamAnalytics/streamingjobs/inputs"
}
cli.knack.cli: Event: Cli.SuccessfulExecute []
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x0430C438>]
az_command_data_logger: exit code: 0
cli.main: Command ran in 2.762 seconds (init: 0.853, invoke: 1.909)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4088 in cache file under C:\Users\babogdan.azure\telemetry\20260615100637580
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry_init.pyc C:\Users\babogdan.azure C:\Users\babogdan.azure\telemetry\20260615100637580"
telemetry.process: Return from creating process 31700
telemetry.main: Finish creating telemetry upload process.

Az --version:

azure-cli 2.84.0 *
core 2.84.0 *
telemetry 1.1.0

Extensions:
datafactory 0.7.0
stream-analytics 1.0.2

Dependencies:
msal 1.35.0b1
azure-mgmt-resource 24.0.0

Minimum API Version Required

n/a

Swagger PR link / SDK link

n/a

Request Example

No response

Target Date

n/a

PM Contact

n/a

Engineer Contact

ychenu@microsoft.com

Additional context

No response