# EXAMPLE 1: Export combined allowlist to a file (already available via "Export CSV")
#   Use this CSV to feed your firewall automation or change control.

# EXAMPLE 2: Azure Firewall (Network Rule Collection) - append address prefixes
# NOTE: Replace placeholders with your specifics. For large lists, batch in chunks.
$rg = "rg-networking"
$fw = "azfw-ngc-egress"
$rcg = "Allow-PowerBI-Services"
$ruleName = "Allow-PowerBI-All"

# Load prefixes from CSV (ServiceTag,Region,Prefix,Source)
$rows = Import-Csv ".allowlist.csv"
$prefixes = $rows | Select-Object -Expand Prefix -Unique

# Fetch existing rule collection config (illustrative)
$afw = Get-AzFirewall -Name $fw -ResourceGroupName $rg
$rule = $afw.NetworkRuleCollections | Where-Object {$_.Name -eq $rcg} |
        ForEach-Object { $_.Rules | Where-Object {$_.Name -eq $ruleName} }

# Merge new prefixes with existing FQDN Tags/IPs as needed (pseudo)
# Update-AzFirewallNetworkRule - not a real cmdlet; use Set-AzFirewall with full object mutation pattern.
# For vendor firewalls (Palo Alto/FortiGate), transform CSV to vendor CLI or API calls.