Azure Virtual Network Manager (AVNM) is a centralized, cross region, multi subscription network orchestration service that simplifies the way organizations design, deploy, and govern their cloud virtual network (VNet) infrastructure. As cloud environments scale, manually managing connectivity, security rules, and IP address usage becomes complex.
This service addresses this by offering policy driven, global management for connectivity, security, and routing, all of them applied consistently across Your Azure environments.
In short, the service allows you to group VNets into network groups, then apply configurations to them at scale. Groups can be built in two ways:
- Static membership: manually added virtual networks.
- Dynamic membership: automatically managed through Azure Policy.
These groups form the basis for applying connectivity, routing, and security configurations across subscriptions and regions.
Core capabilities of Azure Virtual Network Manager
During the creation process, you define the scope for what your Azure Virtual Network Manager instance, or network manager, manages. Your network manager only has the delegated access for resource visibility, configuration deployment, and IP address management within this scope boundary.
After you deploy the network manager, you create a network group, which serves as a logical container of networking resources to apply configurations at scale. You can manually select individual virtual networks to add to your network group, or you can use Azure Policy to define conditions that govern your group membership dynamically.
As far as the network topology, there are several technology patterns:
- Mesh topology: All virtual networks in the group, connect to each other. This is useful for low-latency communications, any type of micro-services and/or internal workloads. In addition, You can set up a cross-region global mesh as well.
- Hub-and-Spoke topology: Spoke network connectivity is only established to the hub (central communication network). The Azure Virtual Network Manager enables direct connectivity between spokes, and uses the hub as gateway (VPN, Express Route).
- Hybrid topology: This one combines hub centralization with optional spoke-to-spoke direct link for optimized traffic (Hub-and-Spoke with direct connectivity.
Once you create your desired network groups and configurations, you can deploy the configurations to any region of your choosing. But, be aware that configurations don’t take effect until you deploy them to regions containing your target network resources.
Azure Virtual Network Manager will automatically maintain the topology, as virtual networks get added/removed.
Comparison: Traditional VNet peering vs. Azure Virtual Network manager
Naturally, this is the first thing that pops up to anyone working with Azure networking. Azure Virtual Network Manager ( introduces a centralized approach to network connectivity management that significantly expands on what traditional VNet peering capabilities.
While both methods enable communication between VNets, they differ dramatically in scale, governance, automation, and security capabilities. If we summarize, these are the key differences:
- Traditional VNet peering is workload-focused and best for smaller, simpler environments where manual connectivity configuration is acceptable.
- Azure Virtual Network Manager is infrastructure focused and designed for large, complex, enterprise-grade environments. Furthermore, it enables centralized policy enforcement, global routing and security consistency,
Security and routing configurations
As part of the Azure Virtual Network Manager, there are couple of resources:
- Network groups: Logical container for virtual networks or subnets from any region.
- Configurations: Settings that can be applied to network resources that belong to a Network group.
As far as the configurations, they can be related to the network topology (Connectivity configurations), security rules are enforced on the virtual networks (Security admin configurations) and common routing settings across virtual networks and subnets (Routing configurations).
Security admin rules allow or deny traffic on specific ports, protocols, and source or destination IP prefixes in a specified direction.
We apply them globally, before the Network Security Groups (NSGs). Furthermore, if necessary they can override the NSGs. The reason being is to enforce specific enterprise security standards. In addition to that, helps prevent configuration drifts or unsafe port exposure.
Examples include:
- Restricting outbound internet access
- Blocking high-risk ports
- Force-allowing traffic to monitor or update services
Security admin rules are ideal for large enterprises that need non by-passable network security governance.
When it comes to routing, the service enables routing consistency and automation as well as central management of IP addressees. We create UDR rule collections and apply them across virtual networks. In virtual network manager, you create a routing configuration. Inside the configuration, you create rule collections to describe the UDRs needed for a network group (target network group).
By applying the rule collection on the virtual networks, we enable the firewall-centric routing pattern (as shown above). This covers the hub with firewall, force-tunneling of internet traffic and consistency of user-defined routing in all spokes and subnets.
IP address management
In addition, the IP address management (IPAM) capability enables allocating non-overlapping addressees. This avoids potential conflicts in multi subscription or hybrid environments.
While it provides governance for VNets, it doesn’t automatically prevent overlapping address spaces during virtual network creation or updates. The only way to prevent this is using Azure Policy with IP address management (IPAM).
Note:
Managing IP address spaces across multiple regions with Azure Virtual Network Manager is currently in preview. It is available in West Europe, East US, UK South, North Europe, and US Central.
In the above diagram, you have hub-and-spoke topology deployed in two different Azure regions. They are deployed in two different Azure regions (West US 2 and West US 3). Both of the hubs are connected trough global virtual network peering.
Note:
IP address management (IPAM) feature in Azure Virtual Network Manager is generally available in all regions where Azure Virtual Network Manager is available except: Chile Central, Jio India West, Malaysia West, Qatar Central, South Africa West, and West India.
When you add new virtual network to a network group for spoke virtual networks, the connectivity and routing configurations are automatically applied to the new virtual network. The network manager automatically detects the new virtual network and applies all applicable configurations. When you remove a virtual network from the network group, any applied configurations are automatically removed.
Conclusion
Azure Virtual Network Manager provides a powerful, scalable control plane for modern cloud networking. It simplifies management and reduces operational overhead through automation. Utilizes consistent policies across regions, supports scalability (1000+ virtual networks per group). It supports several network topology types, compatible with existing manual peering and its non-disruptive for existing deployments. This feature is especially valuable for large enterprises, managed service providers, and hybrid cloud architectures.
Be the first to comment