Implement and manage virtual network security using Azure Virtual Network Manager

5.3 Azure Virtual Network Manager Security

📘Microsoft Azure Networking Solutions (AZ-700)

---

1. What is Azure Virtual Network Manager (AVNM)?

• AVNM allows you to manage network security at scale across many VNets in your Azure subscription.
• It simplifies applying security rules, routing, and policies without configuring each VNet individually.
• Key goal: Consistency and centralized control of network security.

Key Components of AVNM

1. Network Groups
   • Logical grouping of network resources like VNets, subnets, or NICs (network interfaces).
   • Example in IT environment: You can create a group for all “web servers” across multiple VNets.
2. Network Manager
   • The container where you configure policies and assign network groups.
3. Security Admin Rules / Policies
   • Set of rules (firewall rules, NSG-like rules) that can be applied to network groups.

---

2. Security Management with AVNM

AVNM allows you to implement and manage virtual network security in Azure with a few key capabilities:

a) Centralized Security Rule Enforcement

• Normally, you’d configure NSGs (Network Security Groups) per subnet or NIC.
• With AVNM, you can apply the same rule across multiple VNets at once.
• Rule types include:
  • Allow or deny specific ports or protocols.
  • Control inbound and outbound traffic.
  • Manage traffic between network groups.

b) Hierarchical Policy Management

• AVNM supports priority-based policies:
  • If multiple rules apply to a resource, the highest priority rule wins.
• This is useful for enforcing critical security policies across the entire organization while allowing specific exceptions for certain VNets.

c) Network Group Security

• AVNM lets you group resources and apply rules to groups rather than individual VNets.
• Example in IT environment:
  • Group all “database servers” in one network group.
  • Apply rules that allow only application servers to communicate with databases.
  • Any new database added to this group automatically inherits the rules.

---

3. Key Features to Know for the Exam

Here’s what Azure expects you to know for AZ-700:

Feature	What It Does	Exam Tip
Network Groups	Logical containers for VNets, subnets, or NICs	Know the difference between VNet groups and individual resources
Security Admin Rules	Centralized rules like NSGs	Remember: AVNM rules can override local NSG rules if higher priority
Global and Regional Scope	Policies can apply to multiple regions	Useful for multi-region VNets
Priority Enforcement	Rules are applied based on priority number	Lower number = higher priority
Default Deny Behavior	Unmatched traffic is denied by default	Always clarify traffic flow and rule order in exams

---

4. How to Implement Security Using AVNM

Here’s a step-by-step process you can explain in an exam:

1. Create a Network Manager
   • Navigate to Azure portal → Search “Virtual Network Manager” → Create new.
   • Assign a subscription and region.
2. Define Network Groups
   • Add VNets, subnets, or NICs to groups.
   • Example: Web-Servers-Group, Database-Servers-Group.
3. Create Security Admin Rules
   • Define rules like:
     • Allow inbound TCP 443 for web servers.
     • Deny inbound TCP 3389 for database servers.
   • Assign priority numbers (lower = higher priority).
4. Assign Rules to Network Groups
   • Map rules to the respective network groups.
   • AVNM automatically enforces these rules across all included VNets.
5. Monitor and Audit
   • Use Azure Monitor, logs, and alerts to track rule application and traffic flow.

---

5. How AVNM Helps in IT Environments

• Centralized security: No need to configure each VNet separately.
• Consistency: Rules are consistent across multiple VNets or regions.
• Scalability: When new resources are added, they automatically inherit rules if they are in a network group.
• Compliance: Ensures organizational security policies are enforced globally.

IT example:

• Company has multiple VNets in different regions.
• All web servers must only accept HTTPS (443) and allow backend DB access.
• Using AVNM, you create network groups, apply rules centrally, and all servers comply automatically.

---

6. Exam Tips – What to Remember

1. Know the difference between NSGs and AVNM rules
   • NSG: Per subnet or NIC.
   • AVNM: Centralized, can override NSG rules depending on priority.
2. Understand Network Groups
   • VNets, subnets, and NICs can belong to multiple network groups.
3. Rules enforcement
   • Lower priority number = higher importance.
   • Default deny for traffic not matched by any rule.
4. Monitoring and auditing
   • AVNM integrates with Azure Monitor and logs to track security compliance.
5. Scope
   • AVNM supports single subscription or multiple subscriptions if required for exam scenarios.

---

✅ Key Takeaways

• AVNM is centralized security management for Azure VNets.
• Use network groups to organize resources logically.
• Apply security admin rules to enforce traffic control consistently.
• Rules have priority and override behavior.
• Always monitor using Azure Monitor and logs.