Skip to content

Commit 20cf857

Browse files
ninjarobotninjarobot
authored
Merge pull request #1246 from CompositionalIT/copilot/add-network-manager-configurations
Add Azure Network Manager support with security admin configurations
2 parents b9aa002 + 81e9681 commit 20cf857

8 files changed

Lines changed: 1523 additions & 0 deletions

File tree

‎RELEASE_NOTES.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
Release Notes
22
=============
33

4+
## 1.9.27
5+
* Network Manager: Add support for Azure Network Manager with security admin configurations, rule collections, rules with IP ranges and service tags, and network groups.
6+
47
## 1.9.26
58
* Virtual Machine Scale Sets: Add support for rolling upgrade policy configuration.
69

‎docs/content/api-overview/resources/network-manager.md‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
---
2+
title: "Network Manager"
3+
date: 2026-04-15T00:00:00-00:00
4+
chapter: false
5+
weight: 5
6+
---
7+
8+
#### Overview
9+
10+
The Network Manager builders are used to create an Azure Network Manager and its associated resources for centralized network policy management across subscriptions or management groups.
11+
12+
- Network Manager (`Microsoft.Network/networkManagers`)
13+
- Network Manager Group (`Microsoft.Network/networkManagers/networkGroups`)
14+
- Security Admin Configuration (`Microsoft.Network/networkManagers/securityAdminConfigurations`)
15+
- Security Admin Rule Collection (`Microsoft.Network/networkManagers/securityAdminConfigurations/ruleCollections`)
16+
- Security Admin Rule (`Microsoft.Network/networkManagers/securityAdminConfigurations/ruleCollections/rules`)
17+
18+
#### Builder Keywords
19+
20+
##### `networkManager`
21+
22+
| Keyword | Purpose |
23+
|---------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|
24+
| name | Sets the name of the Network Manager. |
25+
| description | Sets an optional description. |
26+
| add_scope_subscription | Adds a subscription to the scope. A bare subscription ID (GUID) is automatically prefixed with `/subscriptions/`. |
27+
| add_scope_subscriptions | Adds multiple subscriptions to the scope. Bare subscription IDs are automatically prefixed with `/subscriptions/`. |
28+
| add_scope_management_groups | Adds management group resource IDs to the scope. |
29+
| add_scope_access | Adds a scope access type — `SecurityAdmin` or `Connectivity`. |
30+
| add_scope_accesses | Adds multiple scope access types. |
31+
| add_network_groups | Adds one or more `networkManagerGroup` configurations to be created under this manager. |
32+
| add_security_admin_configurations | Adds one or more `networkManagerSecurityAdminConfiguration` configurations to be created under this manager. |
33+
| depends_on | Specifies explicit resource dependencies. |
34+
| add_tags | Adds resource tags. |
35+
| add_tag | Adds a single resource tag. |
36+
37+
##### `networkManagerGroup`
38+
39+
A network group is a logical container for virtual networks. It can be defined inline inside a `networkManager {}` block via `add_network_groups`, or created independently by linking it to an existing manager.
40+
41+
| Keyword | Purpose |
42+
|--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
43+
| name | Sets the name of the network group. |
44+
| description | Sets an optional description. |
45+
| link_to_network_manager | Links this group to a Farmer-managed Network Manager in the same deployment. |
46+
| link_to_unmanaged_network_manager | Links this group to an existing Network Manager outside this deployment. |
47+
48+
##### `networkManagerSecurityAdminConfiguration`
49+
50+
A security admin configuration is the top-level container for rule collections. It can be defined inline inside `networkManager {}` via `add_security_admin_configurations`, or created independently by linking it to a manager.
51+
52+
| Keyword | Purpose |
53+
|--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
54+
| name | Sets the name of the security admin configuration. |
55+
| description | Sets an optional description. |
56+
| add_rule_collections | Adds one or more `networkManagerSecurityAdminRuleCollection` configurations. |
57+
| link_to_network_manager | Links this configuration to a Farmer-managed Network Manager in the same deployment. |
58+
| link_to_unmanaged_network_manager | Links this configuration to an existing Network Manager outside this deployment. |
59+
60+
##### `networkManagerSecurityAdminRuleCollection`
61+
62+
A rule collection groups security admin rules and specifies which network groups they apply to. At least one network group must be supplied via `add_applies_to_group`; a `FarmerException` is raised at build time if none are provided.
63+
64+
| Keyword | Purpose |
65+
|--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
66+
| name | Sets the name of the rule collection. |
67+
| description | Sets an optional description. |
68+
| add_applies_to_group | Adds a network group resource ID that this rule collection targets. At least one is required. |
69+
| add_rules | Adds one or more `networkManagerSecurityAdminRule` configurations. |
70+
71+
##### `networkManagerSecurityAdminRule`
72+
73+
Individual security admin rules control traffic flow. Sources and destinations may each be either IP prefixes or service tags, but cannot mix both types within the same direction — a `FarmerException` is raised at build time if mixing is attempted. When no port ranges are specified, all ports (`0-65535`) are used by default.
74+
75+
| Keyword | Purpose |
76+
|--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
77+
| name | Sets the name of the rule. |
78+
| description | Sets an optional description. |
79+
| priority | Sets the rule priority (1–4096, default: 100). |
80+
| direction | Sets traffic direction: `SecurityAdmin.Inbound` or `SecurityAdmin.Outbound`. |
81+
| allow_traffic | Sets the rule action to `Allow` (default). |
82+
| always_allow_traffic | Sets the rule action to `AlwaysAllow` — overrides lower-priority deny rules. |
83+
| deny_traffic | Sets the rule action to `Deny`. |
84+
| protocol | Sets the protocol: `SecurityAdmin.TCP`, `SecurityAdmin.UDP`, `SecurityAdmin.ICMP`, `SecurityAdmin.ESP`, `SecurityAdmin.AH`, or `SecurityAdmin.AnyProtocol`. |
85+
| add_source_ip_prefix | Adds an IP prefix as a source address (e.g. `"10.0.0.0/8"`). |
86+
| add_source_service_tag | Adds a service tag as a source (e.g. `"Internet"`, `"AzureCloud"`). |
87+
| add_destination_ip_prefix | Adds an IP prefix as a destination address (e.g. `"192.168.0.0/16"`). |
88+
| add_destination_service_tag | Adds a service tag as a destination (e.g. `"VirtualNetwork"`). |
89+
| add_source_port_range | Adds a source port or range (e.g. `"80"`, `"1024-65535"`). |
90+
| add_source_port_ranges | Adds multiple source port ranges. |
91+
| add_destination_port_range | Adds a destination port or range. |
92+
| add_destination_port_ranges | Adds multiple destination port ranges. |
93+
94+
#### Example
95+
96+
This example creates a Network Manager spanning two subscriptions with a security admin configuration that blocks inbound Internet traffic on common management ports.
97+
98+
```fsharp
99+
#r "nuget:Farmer"
100+
101+
open Farmer
102+
open Farmer.Builders
103+
open Farmer.Arm.NetworkManager
104+
105+
let prodGroup = networkManagerGroup {
106+
name "prod-vnets"
107+
description "Production virtual networks"
108+
}
109+
110+
let blockManagementFromInternet = networkManagerSecurityAdminRule {
111+
name "deny-internet-management"
112+
priority 100
113+
direction SecurityAdmin.Inbound
114+
deny_traffic
115+
protocol SecurityAdmin.TCP
116+
add_source_service_tag "Internet"
117+
add_destination_ip_prefix "10.0.0.0/8"
118+
add_destination_port_range "22"
119+
add_destination_port_range "3389"
120+
}
121+
122+
let baselineCollection = networkManagerSecurityAdminRuleCollection {
123+
name "baseline-rules"
124+
add_applies_to_group (networkManagerGroups.resourceId (ResourceName "my-network-manager/prod-vnets"))
125+
add_rules [ blockManagementFromInternet ]
126+
}
127+
128+
let baselineConfig = networkManagerSecurityAdminConfiguration {
129+
name "baseline-config"
130+
add_rule_collections [ baselineCollection ]
131+
}
132+
133+
let myManager = networkManager {
134+
name "my-network-manager"
135+
description "Centralised network policy manager"
136+
// Bare subscription GUIDs are automatically prefixed with /subscriptions/
137+
add_scope_subscription "00000000-0000-0000-0000-000000000001"
138+
add_scope_subscription "00000000-0000-0000-0000-000000000002"
139+
add_scope_access SecurityAdmin
140+
add_network_groups [ prodGroup ]
141+
add_security_admin_configurations [ baselineConfig ]
142+
}
143+
144+
arm {
145+
location Location.EastUS
146+
add_resource myManager
147+
}
148+
```
149+
150+
#### Standalone Builders (linking to an existing manager)
151+
152+
Both `networkManagerGroup` and `networkManagerSecurityAdminConfiguration` implement `IBuilder` and can be added directly to an `arm {}` block without a wrapping `networkManager {}`, by linking to a pre-existing or Farmer-managed manager.
153+
154+
```fsharp
155+
#r "nuget:Farmer"
156+
157+
open Farmer
158+
open Farmer.Builders
159+
open Farmer.Arm.NetworkManager
160+
161+
// Attach a group to a pre-existing network manager
162+
let extraGroup = networkManagerGroup {
163+
name "dev-vnets"
164+
description "Developer virtual networks"
165+
link_to_unmanaged_network_manager (networkManagers.resourceId (ResourceName "my-network-manager"))
166+
}
167+
168+
// Attach a security admin configuration to a pre-existing network manager
169+
let extraConfig = networkManagerSecurityAdminConfiguration {
170+
name "extra-config"
171+
link_to_unmanaged_network_manager (networkManagers.resourceId (ResourceName "my-network-manager"))
172+
add_rule_collections [ baselineCollection ]
173+
}
174+
175+
arm {
176+
location Location.EastUS
177+
add_resource extraGroup
178+
add_resource extraConfig
179+
}
180+
```

0 commit comments

Comments
 (0)