When the same control must apply to many virtual networks, editing NSGs one by one is slow and easy to undo locally. Azure Virtual Network Manager (AVNM) centralises connectivity and security configuration across a management scope.
Security admin rules
- Azure Virtual Network Manager (AVNM) security admin rules are defined once and apply to every VNet in the targeted network group, including VNets added later: the least-effort way to block a port across many VNets. Editing each NSG is more work and local owners can override; UDRs change the next hop, not ports.
- Security admin rules are always evaluated before NSG rules, whatever the NSG priority. Figure 7.1 shows where each security admin action sends the traffic.
| Security admin action | Effect |
|---|---|
| Allow | Passes traffic on to NSG evaluation |
| Deny | Blocks, regardless of NSGs |
| Always allow | Permits, regardless of NSGs |
AVNM features
| AVNM feature | Does |
|---|---|
| Connectivity configuration | Builds mesh (every VNet in a group connected bidirectionally) or hub-and-spoke; doesn’t filter |
| Security admin configuration | Central allow/deny rules evaluated before NSGs |
| Routing configuration | Steers traffic via next hops |
| IPAM | Allocates non-overlapping address space |
| Scope | Subscriptions/management groups the manager governs |
Network groups and overlapping managers
- Network groups: only resources inside the management scope can be members (a VNet in a subscription outside that scope can’t, even with a matching tag). Groups are global, so member region doesn’t matter. Membership is many-to-many. The member type is virtual network or subnet.
- Static membership includes only explicitly added VNets; dynamic (tag-based) membership uses Azure Policy and automatically adds any matching VNet in scope, including later ones.
- Overlapping managers with conflicting configurations: the higher scope wins (management group beats subscription).
Common trap: Assuming internet traffic still reaches a VM because a lower-scope configuration or its NSG allows it - when a management-group-scoped manager applies a conflicting Deny, the higher scope wins and the traffic is blocked.