Ask for feedback - Azure Virtual Network Manager network groups in Azure Landing Zones

[sebassem]

Azure Virtual Network Manager(AVNM) is a management service that enables you to group, configure, deploy, and manage virtual networks globally across subscriptions. With Virtual Network Manager, you can define network groups to identify and logically segment your virtual networks. Then you can determine the connectivity and security configurations you want and apply them across all the selected virtual networks in network groups at once.

As the ALZ team is working currently on introducing AVNM into the reference implementation we want to get the community's initial thoughts on how we are thinking about implementing Network groups with respect to Security admin rules and in the future UDR management.

Our plan is to create the following groups for you in the reference implementation and we will provide later in our documentation guidance on how to tackle other scenarios. We will use Azure Policy for dynamic membership to the groups as follows:

Network Group	Azure Policy
All VNet - All Regions	Assignment at Int Root: Implement a policy assignment at the root level without any resource selector
All VNet - Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering
Corp VNet - Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering
Online VNet- Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering
Identity VNet - Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering
Management VNet - Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering
Connectivity VNet - Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering
Sandbox VNet- Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering
Decommissioned VNet - Per Region	Policy Assignment: Assign one policy per region with a resource selector for location filtering

Let us know what you think 💡

[jtracey93]

Have been thinking this through more since we discussed internally earlier this week. Also with some other colleagues.

Have got these points so far for consideration:

1. We might not need All VNet - Per Region. Reason: it's doesnt really have a value
2. We might want to add a new Network Group for Connectivity VNets - All Regions. Reason: Could be used in connectivity feature to enable peering/mesh between all hubs in large customers easily. Including utility hubs, if we go down that route for Private DNS Resolver and Bastion etc.