Issue with SSL Profiles in AZUre

Hi Matthias Holmberg,

Thanks for reaching out in Microsoft Q&A forum,

I have added a ssl profile in Azure Portal and then choose the "verifyClientAuthMode: 'Passthrough'" But when i look into the arm template its not set at all. Is this a bug or am i doing something wrong?

The verifyClientAuthMode: Passthrough property only exists in API version 2025-03-01. The Azure Portal still uses older API versions and validation logic that don’t recognize this property. When you select it in the UI, the Portal accepts your input but silently strips it during save because its backend schema doesn’t include the field yet.

Why ARM templates work: When you deploy via ARM with apiVersion: 2025-03-01, you’re talking directly to the newer control plane that understands passthrough mode. The Portal can’t do this yet.

Even after successful ARM deployment, if you open the gateway in the Portal and click “Save,” the Portal will re-validate using its old schema and wipe out your passthrough config.

Official docs: Deploy mTLS passthrough with ARM template

When i deploy anything to our AKS using AGIC it gets overwritten with static client auth. ****

AGIC runs a reconciliation loop every 30–60 seconds. It reads your Kubernetes Ingress resources, builds a “desired state,” then compares it to the actual gateway config. Anything on the gateway that isn’t in Kubernetes gets deleted as “drift.”

Since AGIC has no way to express verifyClientAuthMode: Passthrough in Kubernetes (no annotation, no CRD field), your SSL profile never appears in AGIC’s desired state. So AGIC treats it as rogue config and removes it.

Why shared mode helps: With appgw.shared: true, AGIC switches from “delete everything I don’t own” to “only manage what I create.” Your manually deployed SSL profile survives because AGIC no longer claims full ownership.

Official docs:

• Prevent AGIC from overwriting
• Install AGIC with existing gateway

Kindly let us know if the above helps or you need further assistance on this issue.

Please “Accept Answer” wherever the information provided helps you, this can be beneficial to other community members.