1.4 Azure Virtual Network Manager (AVNM) & Network Groups

Azure Virtual Network Manager (AVNM) & Network Groups

As enterprise cloud footprints expand across dozens of subscriptions, multiple management groups, and global Azure regions, managing individual virtual network peerings, route tables, and network security groups becomes unmanageable. Manual peering creation is prone to configuration drift, and local subscription owners can inadvertently bypass organizational security baselines.

Azure Virtual Network Manager (AVNM) is a highly scalable management service that enables central administration of connectivity and security policies across your entire Azure tenant hierarchy.

1. AVNM Architecture & Management Scopes

AVNM operates at the enterprise control plane. When provisioning an AVNM instance, you assign it an administrative Scope that defines the boundary of resources it can manage:

• Management Group Scope: Covers all child management groups and subscriptions beneath the designated management group.
• Subscription Scope: Covers one or more explicitly selected subscriptions.

+-----------------------------------------------------------------------------+
|                   AZURE VIRTUAL NETWORK MANAGER ARCHITECTURE                |
|                                                                             |
|   Tenant Root Management Group                                              |
|   └── Core-Enterprise Management Group [AVNM Instance Scope]                |
|       ├── Connectivity Features: Global Mesh, Hub-and-Spoke Automation      |
|       └── Security Admin Features: High-Priority Baseline Rules             |
|                                                                             |
|       ├── Subscription: Prod-EastUS (Auto-joined via Tag: Env=Prod)         |
|       ├── Subscription: Prod-WestEurope (Auto-joined via Tag: Env=Prod)     |
|       └── Subscription: Shared-Services-Hub                                 |
+-----------------------------------------------------------------------------+

AVNM Core Capabilities:

1. Connectivity Management: Automates full mesh topologies or hub-and-spoke architectures (including direct spoke-to-spoke connectivity) without manual bidirectional peering links.
2. Security Admin Management: Enforces global security admin rules across thousands of VNets that take precedence over local Network Security Groups (NSGs).
3. Routing Management: Centrally controls hub routing configurations and user-defined route propagation.

2. Network Groups: Static vs. Dynamic Membership

A Network Group is a logical container within AVNM that groups virtual networks together for policy and connectivity assignment.

+-----------------------------------------------------------------------------+
|                     STATIC VS. DYNAMIC NETWORK GROUP MEMBERSHIP             |
|                                                                             |
|   [STATIC MEMBERSHIP]                     [DYNAMIC MEMBERSHIP (ARG)]        |
|   - Explicitly select VNet-1, VNet-2      - Azure Resource Graph Query:     |
|   - Manual update required when             WHERE tags['Environment'] ==     |
|     new VNets are created                   'Production' AND type ==         |
|   - Ideal for stable Hub VNets              'Microsoft.Network/virtualNetworks'|
|                                           - Auto-adds new VNets instantly!  |
+-----------------------------------------------------------------------------+

Dynamic Membership with Azure Resource Graph (ARG)

Dynamic membership uses conditional statements evaluated by Azure Resource Graph. When an engineer provisions a new VNet anywhere in the organization with matching tags or naming conventions, AVNM automatically includes the VNet in the network group and applies the associated connectivity and security rules.

{
  "allOf": [
    {
      "field": "tags['Environment']",
      "equals": "Production"
    },
    {
      "field": "tags['Tier']",
      "equals": "Backend"
    }
  ]
}

3. Connectivity Configurations: Topologies & Direct Connectivity

AVNM simplifies complex topology deployments through declarative Connectivity Configurations:

1. Mesh Topology

• All virtual networks in the network group are automatically connected to each other via direct VNet peering.
• Supports Global Mesh, enabling multi-region full-mesh connectivity across global datacenters with a single configuration.

2. Hub-and-Spoke Topology

• Designates a central Hub VNet and connects spoke network groups to it.
• Direct Connectivity Option: When configuring a hub-and-spoke topology, you can enable Direct Connectivity for specific spoke network groups. This creates direct peering links between spoke VNets within the same group while preserving their connection to the hub, eliminating the need to hairpin inter-spoke traffic through a hub firewall when not required.

4. Security Admin Configurations & Security Admin Rules (SAR)

Security Admin Rules allow enterprise security teams to enforce mandatory, immutable network security policies across all VNets in a network group.

Evaluation Order: SAR vs. NSG

[!IMPORTANT] Strict Precedence Hierarchy: Security Admin Rules are evaluated BEFORE local Network Security Groups (NSGs). Local subscription owners or developers cannot override or circumvent a Security Admin Rule.

Security Admin Rule Actions:

• Allow: The packet is explicitly permitted through the security admin layer and completely bypasses local NSGs. Local NSGs are never evaluated for this packet.
• Deny: The packet is immediately dropped at the platform layer, bypassing local NSGs. Even if a local developer creates an NSG rule with priority 100 allowing the traffic, the packet is blocked.
• AlwaysAllow: High-priority absolute permit for mission-critical services.
• Pass: The packet passes through the security admin layer without decision and is delegated down to the local Network Security Groups (NSGs) for standard evaluation.

5. The AVNM Deployment Workflow

Creating a configuration in AVNM does not apply it to your infrastructure immediately. AVNM uses a safe, staged Commit and Deploy lifecycle:

+-----------------------------------------------------------------------------+
|                          AVNM DEPLOYMENT LIFECYCLE                          |
|                                                                             |
|   [1. CREATE AVNM]   ---> Provision Manager instance with Management Scope  |
|                                     |                                       |
|                                     v                                       |
|   [2. NETWORK GROUPS] ---> Define static or dynamic (ARG) membership        |
|                                     |                                       |
|                                     v                                       |
|   [3. CONFIGURATIONS] ---> Build Connectivity or Security Admin configs     |
|                                     |                                       |
|                                     v                                       |
|   [4. DEPLOY CONFIG]  ---> Explicitly select target regions & COMMIT        |
|                            (Changes take effect ONLY after deployment!)     |
+-----------------------------------------------------------------------------+

[!CAUTION] Exam Trap - Uncommitted Configurations: If you create a Network Group and configure a Mesh Connectivity rule or Security Admin rule, but do not execute the Deploy step targeting the specific Azure regions, the peering links and security rules will not exist on the member virtual networks.