services / Azure / Network Manager

Azure Virtual Network Manager is a centralized governance layer that authors and pushes connectivity configurations and security-admin rules across many VNets at once within a defined network group scope.

A single manager governs connectivity and security-admin rules across many VNets simultaneously; security-admin rules override per-VNet NSGs, so control of the manager is an org-wide policy/segmentation blast-radius multiplier, warranting CRITICAL.

Microsoft.​Network/​networkManagers/​listActiveConnectivityConfigurations/​action

Lists the connectivity configurations currently in effect across the managed VNet scope, revealing which VNets are meshed/hub-connected and thus the reachable network topology for lateral movement.

Risks

1. Network discovery (LOW)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links