services / Azure / Network Manager

Azure Virtual Network Manager is a centralized governance layer that authors and pushes connectivity configurations and security-admin rules across many VNets at once within a defined network group scope.

A single manager governs connectivity and security-admin rules across many VNets simultaneously; security-admin rules override per-VNet NSGs, so control of the manager is an org-wide policy/segmentation blast-radius multiplier, warranting CRITICAL.

Microsoft.​Network/​networkManagers/​listActiveSecurityUserRules/​action

Lists the security-user rules currently in effect across the managed VNet scope, disclosing the enforced network filtering posture an attacker can use to find gaps.

Risks

1. Network discovery (LOW)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links