3.3.2. Azure Virtual Network Manager and Virtual WAN Security
💡 First Principle: Managing NSG rules VNet-by-VNet doesn't scale once an organization has dozens or hundreds of virtual networks — centralized tools exist specifically to apply consistent network security policy across many VNets at once, rather than relying on every team to replicate the same rules correctly by hand.
Azure Virtual Network Manager lets you group VNets (by subscription, region, or explicit membership) and apply centrally-managed security admin rules across all of them — critically, security admin rules can be configured to evaluate before NSG rules and can explicitly override a local NSG's allow rule, giving central security teams a way to enforce a non-negotiable baseline that individual resource owners can't accidentally weaken. Azure Virtual WAN provides a hub-and-spoke network architecture at global scale, with security typically enforced through an integrated or connected Azure Firewall at the hub.
⚠️ Exam Trap: A locally-configured NSG allow rule is not guaranteed to be the final word — if a centrally-managed security admin rule with higher evaluation priority denies that same traffic, the admin rule wins. A scenario where traffic is unexpectedly blocked despite an apparently correct local NSG rule may be pointing at a Virtual Network Manager security admin rule the local resource owner isn't even aware of.
Reflection Question: Why would a central security team specifically want security admin rules to be capable of overriding a local resource owner's NSG configuration, rather than just recommending a baseline?
