Night-shift monitoring must reach every lock VM on TCP 443 from a j…

Question

Night-shift monitoring must reach every lock VM on TCP 443 from a jump subnet, but app teams keep adding Deny rules that break the probes. Which Azure Virtual Network Manager action should the security engineer use?

Accepted Answer

AlwaysAllow for the management flow so NSG evaluation is skipped and local Denies cannot block it. — Probes keep dying under local Deny graffiti. Use an AVNM AlwaysAllow for jump-subnet-to-443—NSGs never get a vote on that path.

Answer

Allow, so NSG evaluation continues and local Denies can still block the probes.

Answer

Deny, so monitoring traffic is dropped before it reaches the lock VMs.

Answer

Just-in-time VM access on each lock VM instead of a network-wide management rule.

Night-shift monitoring must reach every lock VM on TCP 443 from a jump subnet, but app teams keep adding Deny rules that break the probes. Which Azure Virtual Network Manager action should the security engineer use?

Short Explanation

Full Explanation