Get private IP addresses for VMs in a Scale Set via Python SDK (no public IP addresses in Scale Set)

I'm trying to get a list of private IP addresses for all VMs in a Scale Set (none of the VMs deliberately has any public IP addresses). I've found how to get this from az cli as follows:

az vmss nic list -g ResourceGroup --vmss-name ScaleSetName --query [].{ip:ipConfigurations[0].privateIpAddress} -o tsv

However I'm unable to get the same output using Python SDK. I am using the following basic code:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.compute import ComputeManagementClient

credentials = ServicePrincipalCredentials(client_id = CLIENT, secret = KEY, tenant = TENANT)

compute_client = ComputeManagementClient(credentials, SUBSCRIPTION)

vmss = compute_client.virtual_machine_scale_sets.get(RG, SC)
print(vmss.virtual_machine_profile.network_profile.network_interface_configurations[0].ip_configurations[0])

Is this the right place in the SDK object model to look for them? From what I understand, the network properties should be at the Scale Set level, and that's the only place in the API where I see anything network-related. However, I only see 'private IP version' in the subsequent properties, and since there are no public IPs, that portion of the properties is blank.

Unfortunately, I'm afraid you cannot get the private IP of virtual machine scale set instances. The network interfaces of virtual machine scale sets are not the resources in Azure and you cannot get them. Currently, Azure python SDK does not support get the VMSS private IPs through the python SDK.

You can try to use the REST API to achieve the purpose and get the REST API via the CLI command debug like this:

az vmss nic list -g ResourceGroup --vmss-name ScaleSetName --query [].{ip:ipConfigurations[0].privateIpAddress} -o tsv --debug

It will show the progress and the REST API:

If you're already using the Python azure sdk, you can pull the Bearer token from the azure.identity credential which makes this REST API call much easier to do:

credentials = ClientSecretCredential(
    client_id=os.environ['AZURE_CLIENT_ID'],
    client_secret=os.environ['AZURE_CLIENT_SECRET'],
    tenant_id=os.environ['AZURE_TENANT_ID']
)  

# Grab the bearer token from the existing azure credential,
# and use it to AUTH the REST api call:
rest_token = credentials._request_token('https://management.core.windows.net//.default')
vmss_nic_json = vmss_rest_api_list_nics(rest_token.token, subscription_id, resource_group, vmss_name)

# REST API call:
def vmss_rest_api_list_nics(token, subscription_id, resource_group, vmss_name, api_version='2018-10-01'):
    
    url = f"https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/microsoft.Compute/virtualMachineScaleSets/{vmss_name}/networkInterfaces"
    params = {'api-version': api_version}
    request = requests.Request('GET', url, params=params)
    prepped = request.prepare()
    prepped.headers['Authorization'] = f'Bearer {token}'

    with requests.Session() as session:
        response = session.send(prepped )

        if( response.status_code == 200 ):
            return json.loads(response.text)
        else:
            logger.error(f"Failed to communicate with api service: HTTP {response.status_code} - {response.text}")
            return None