☁️ Azure Network Manager Admin Rule Terraform Module

A single security admin rule — the resource that is evaluated before network security groups, and that two of its three actions let it override entirely. Targets hashicorp/azurerm ~> 4.0.

• 🛡️ Writes one security admin rule into a network manager rule collection.
• ⚖️ Emits the action as four derived flags, because Allow, Deny and AlwaysAllow differ in more than severity.
• 🎯 Reports how wide the match is — and flags the case where all five wildcards hold at once.
• 🏷️ Reports service tags Microsoft documents as unsupported here, and destination ports on Microsoft's own high-risk list.
• ⚠️ States four things it cannot see, including which networks the rule reaches and whether anything is deployed.

💡 Why it matters: Microsoft documents security admin rules as always outranking network security group rules. Allow passes traffic on for NSG evaluation; Deny and AlwaysAllow end the evaluation there. So a rule written here can block traffic a team has explicitly permitted, or deliver traffic they have explicitly denied — and they cannot override back. Reading action = "AlwaysAllow" does not convey that unless you already know the model, which is why this module emits it.

If this module saved you time:

• ⭐ Star the repository — it genuinely helps other people find it.
• 💼 Connect on LinkedIn — linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee — buymeacoffee.com/microsoftexpert

flowchart TB
    NM["terraform-azurerm-network-manager"]
    CFG["a security admin configuration -- not authored as a module yet"]
    COLL["terraform-azurerm-network-manager-admin-rule-collection"]
    RULE["terraform-azurerm-network-manager-admin-rule"]
    GRP["network groups -- the collection names them, and they decide the blast radius"]
    NSG["network security groups on the targeted virtual networks"]
    DEP["a network manager DEPLOYMENT -- nothing takes effect until this exists"]

    NM -->|"owns the configuration"| CFG
    CFG -->|"id to security_admin_configuration_id"| COLL
    COLL -->|"id to admin_rule_collection_id"| RULE
    GRP -->|"ids to network_group_ids on the COLLECTION, not the rule"| COLL
    RULE -->|"EVALUATED FIRST -- Deny and AlwaysAllow never consult these"| NSG
    DEP -.->|"until the configuration is deployed, every rule here is INERT"| CFG

    classDef self fill:#0078D4,stroke:#004578,color:#ffffff
    classDef keystone fill:#004578,stroke:#002B4A,color:#ffffff
    classDef ext fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    class RULE self
    class COLL keystone
    class NM,CFG,GRP,NSG,DEP ext

Follow two edges. The network groups arrive at the collection, not here — which is why no output in this module reports a network count. And the edge from this rule to the network security groups is the feature: evaluated first, and for two of the three actions, never reaching them at all.

flowchart TB
    IN1["name and admin_rule_collection_id -- the only force-new fields"]
    IN2["action -- Allow continues to NSGs; Deny and AlwaysAllow END evaluation"]
    IN3["priority 1 to 4096, LOWER WINS -- collisions invisible from here"]
    IN4["protocol, direction, ports, sources, destinations"]
    RES["azurerm_network_manager_admin_rule.this -- a real ARM record, no locks"]
    OUT1["a real Resource ID plus the manager, configuration and collection names"]
    OUT2["terminates_evaluation_before_network_security_groups"]
    OUT3["matches_everything_in_its_direction, and the unsupported service tags"]
    OUT4["limits -- the collection decides the networks, siblings are invisible"]

    IN1 --> RES
    IN2 --> RES
    IN3 --> RES
    IN4 --> RES
    RES --> OUT1
    RES --> OUT2
    RES --> OUT3
    RES --> OUT4

    classDef self fill:#0078D4,stroke:#004578,color:#ffffff
    classDef ext fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    class RES self
    class IN1,IN2,IN3,IN4,OUT1,OUT2,OUT3,OUT4 ext

Only name and admin_rule_collection_id are force-new. The action updates in place.

• 🔴 Two of the three actions terminate evaluation. Deny and AlwaysAllow stop traffic evaluation at this rule — the network security group is never consulted. Only Allow passes traffic on.
• 🔴 The action is NOT force-new. Flipping a rule from Allow to Deny is an in-place update whose effect is traffic being blocked across every virtual network the collection reaches.
• 🔴 The port range fields carry NO format validation. The provider checks only that each entry is non-empty, so "http" reaches Azure. This module adds a shape check.
• 🔴 The address prefix is NOT validated against its prefix type. A service tag labelled IPPrefix is accepted by the provider and rejected by Azure. This module refuses that mismatch.
• 🔴 Nothing is enforced until the configuration is DEPLOYED, and enforcement is eventually consistent after that.
• 🟠 protocol is Any/Tcp/Udp/Icmp/Esp/Ah, case-sensitive — not the uppercase names network security group rules use, so a rule copied from an NSG fails on the casing alone.
• 🟠 action is case-sensitive too, and Microsoft's prose writes AlwaysAllow as "Always allow" with a space while the API does not.
• 🟠 priority is 1–4096, lower wins, and collisions within a collection are not detected by the provider or by this module.
• 🟡 description is validated as NON-EMPTY when set — an empty string is refused, omission is fine.
• 🟡 Three service tags are unsupported here — AzurePlatformDNS, AzurePlatformIMDS, AzurePlatformLKM — though they are valid tags elsewhere.
• 🔴 The delete is FORCED and cannot be disabled. The provider hard-codes the service's force flag. Microsoft defines it as "Delete the resource even if it is part of a deployed configuration. If the configuration has been deployed, the service will do a cleanup deployment in the background, prior to the delete." The Azure CLI defaults the same flag to false.
• ✅ A real ARM record, not a composite. Zero locks; several rules write concurrently and safely.
• ✅ An import guard exists, and all four timeouts — there is a real update function.

🔒 This permission overrides other teams' network security groups, in both directions. A Deny written here blocks traffic a virtual network's owners have explicitly allowed, and they cannot restore it. An AlwaysAllow delivers traffic they have explicitly denied, and they cannot block it. Neither appears in their network security group configuration — the rule lives on a network manager they may not be able to read.

⚠️ The action is not force-new, so changing a rule's effect is an in-place update. A plan line reading "1 to change" can be traffic across every virtual network the collection reaches starting to be blocked.

ℹ️ The blast radius is not in this rule's configuration. It is the parent collection's network_group_ids, which someone else may widen without touching this rule at all.

• The Microsoft.Network resource provider registered in the target subscription.
• A network manager, a security admin configuration, and a rule collection — the whole parent chain.
• Network groups on the collection, or the rule reaches nothing.
• 🔴 A deployment of the configuration to a region. Until then the rule is a definition.
• An understanding of the sibling rules' priorities, which this module cannot see.

terraform-azurerm-network-manager-admin-rule/
├── providers.tf    # required_version >= 1.12.0, azurerm ~> 4.0, no provider block
├── variables.tf    # 12 inputs, 15 validations -- the parent, the action, the match
├── main.tf         # one keystone `this`; dynamic source/destination blocks; the action flags
├── outputs.tf      # 47 outputs -- id first, then the action semantics, then what it cannot see
├── README.md       # this file
├── SCOPE.md        # the cross-module contract
├── LICENSE         # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "deny_rdp" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-rdp-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Inbound"
  priority  = 100
  protocol  = "Tcp"

  destination_port_ranges = ["3389"]

  sources = [
    { address_prefix = "Internet", address_prefix_type = "ServiceTag" },
  ]
}

⚠️ That Deny cannot be overridden by any network security group it reaches. See example 2.

module "deny_rdp" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-rdp-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Inbound"
  priority  = 100
  protocol  = "Tcp"
}

# Passes matching traffic ON to network security group evaluation.
# The local team can still deny it.
action = "Allow"

# Blocks it. THE NETWORK SECURITY GROUP IS NEVER CONSULTED.
action = "Deny"

# Delivers it, bypassing any conflicting NSG rule.
# THE NETWORK SECURITY GROUP IS NEVER CONSULTED.
action = "AlwaysAllow"

check "no_central_rule_overrides_a_local_deny" {
  assert {
    condition     = !module.deny_rdp.overrides_a_denying_network_security_group
    error_message = "An AlwaysAllow rule delivers traffic that a network's own team has denied."
  }
}

module "rdp_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "rdp-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny" # was "Allow" -- this is a MODIFICATION, not a replacement
  direction = "Inbound"
  priority  = 100
  protocol  = "Tcp"

  destination_port_ranges = ["3389"]
}

module "deny_rdp" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-rdp-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Inbound"
  priority  = 100 # leave gaps: 100, 200, 300 -- not 1, 2, 3
  protocol  = "Tcp"
}

module "deny_all_inbound" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-all-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Inbound"
  priority  = 4000
  protocol  = "Any" # and no sources, destinations or ports
}

check "no_unconstrained_rule" {
  assert {
    condition     = !module.deny_all_inbound.matches_everything_in_its_direction
    error_message = "This rule constrains nothing: any protocol, any address, any port."
  }
}

destination_port_ranges = ["3389"]        # a single port
destination_port_ranges = ["1000-2000"]   # a range
destination_port_ranges = ["22", "3389"]  # several

# REFUSED by this module -- the PROVIDER would accept it.
destination_port_ranges = ["http"]
destination_port_ranges = ["1000-"]
destination_port_ranges = ["80,443"]

# RIGHT
sources = [
  { address_prefix = "Internet",    address_prefix_type = "ServiceTag" },
  { address_prefix = "10.0.0.0/8",  address_prefix_type = "IPPrefix" },
]

# REFUSED by this module -- the PROVIDER would send it to Azure and fail there.
sources = [
  { address_prefix = "Internet", address_prefix_type = "IPPrefix" },
]

module "deny_platform_dns" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-platform-dns"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Outbound"
  priority  = 200
  protocol  = "Any"

  destinations = [
    { address_prefix = "AzurePlatformDNS", address_prefix_type = "ServiceTag" },
  ]
}

check "only_supported_service_tags" {
  assert {
    condition     = length(module.deny_platform_dns.unsupported_service_tags_used) == 0
    error_message = "A service tag was used that security admin rules do not support."
  }
}

module "deny_high_risk" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-high-risk-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Inbound"
  priority  = 100
  protocol  = "Tcp"

  destination_port_ranges = ["22", "3389", "1433"]

  sources = [
    { address_prefix = "Internet", address_prefix_type = "ServiceTag" },
  ]
}

output "confirming_intent" {
  value = module.deny_high_risk.high_risk_destination_ports_matched
}

output "honest_limits" {
  value = {
    reach       = module.deny_rdp.the_collection_decides_which_networks_this_rule_reaches
    siblings    = module.deny_rdp.the_module_cannot_see_the_other_rules_in_the_collection
    endpoints   = module.deny_rdp.security_admin_rules_do_not_apply_to_private_endpoints
    gateways    = module.deny_rdp.several_gateway_subnet_types_are_exempt_from_these_rules
    manager_only = module.deny_rdp.rules_apply_only_to_networks_the_manager_manages
  }
}

# WRONG -- the CONFIGURATION where the COLLECTION belongs.
admin_rule_collection_id = var.security_admin_configuration_id

# WRONG -- network security group casing.
protocol = "TCP"

# WRONG -- Microsoft's prose spelling.
action = "Always allow"

# WRONG -- an empty description is not the same as none.
description = ""

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-network-eastus"
  location = "eastus"

  tags = {
    environment = "production"
    workload    = "network-governance"
  }
}

module "network_manager" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager.git?ref=v1.0.0"

  name                = "nm-corp"
  resource_group_name = module.rg.name
  location            = module.rg.location

  scope = {
    subscription_ids = [var.managed_subscription_id]
  }

  scope_accesses = ["SecurityAdmin"]

  tags = module.rg.tags
}

# The configuration and the network group are not authored as modules in this
# library yet, so their Resource IDs are passed in.
module "high_risk_ports" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule-collection.git?ref=v1.0.0"

  name                            = "rc-high-risk-ports"
  security_admin_configuration_id = var.security_admin_configuration_id
  network_group_ids               = [var.production_network_group_id]

  description = "Baseline restrictions on high-risk inbound ports"
}

module "deny_rdp" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-rdp-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Inbound"
  priority  = 100
  protocol  = "Tcp"

  destination_port_ranges = ["3389"]

  sources = [
    { address_prefix = "Internet", address_prefix_type = "ServiceTag" },
  ]

  description = "Block inbound RDP from the internet across production"
}

# An AlwaysAllow that guarantees management access regardless of local rules.
module "always_allow_management" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "always-allow-management"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "AlwaysAllow"
  direction = "Inbound"
  priority  = 50 # LOWER than the deny above, so it wins
  protocol  = "Tcp"

  destination_port_ranges = ["22", "3389"]

  sources = [
    { address_prefix = "10.10.0.0/24", address_prefix_type = "IPPrefix" },
  ]

  description = "Guarantee jump-host access to management ports"
}

output "governance" {
  value = {
    deny_terminates      = module.deny_rdp.terminates_evaluation_before_network_security_groups
    deny_high_risk_ports = module.deny_rdp.high_risk_destination_ports_matched
    allow_overrides_nsgs = module.always_allow_management.overrides_a_denying_network_security_group
    allow_priority       = module.always_allow_management.priority
    deny_priority        = module.deny_rdp.priority
    needs_deployment     = module.deny_rdp.this_rule_does_nothing_until_the_configuration_is_deployed
  }
}

Required: name, admin_rule_collection_id, action, direction, priority, protocol Optional: source_port_ranges, destination_port_ranges, sources, destinations, description, timeouts

There is no tags variable — the resource exposes none. Tag the network manager.

variable "name" {
  type = string
  # REQUIRED, FORCE-NEW. Non-empty is the provider's only check.
}

variable "admin_rule_collection_id" {
  type = string
  # REQUIRED, FORCE-NEW. Anchored through /ruleCollections/<collection>.
  # THE COLLECTION decides which networks this rule reaches -- the rule names
  # none, and that list can widen without this rule changing.
}

variable "action" {
  type = string
  # REQUIRED. "Allow" | "Deny" | "AlwaysAllow", case-sensitive.
  # Deny and AlwaysAllow TERMINATE evaluation -- the NSG is never consulted.
  # NOT force-new: changing it is an in-place update.
}

variable "direction" {
  type = string
  # REQUIRED. "Inbound" | "Outbound", case-sensitive. One direction per rule.
}

variable "priority" {
  type = number
  # REQUIRED. 1 to 4096, LOWER WINS. Collisions within a collection are not
  # detectable by this module or by the provider.
}

variable "protocol" {
  type = string
  # REQUIRED. "Any"|"Tcp"|"Udp"|"Icmp"|"Esp"|"Ah", case-sensitive -- NOT the
  # uppercase names network security group rules use.
}

variable "source_port_ranges" {
  type    = list(string)
  default = []
  # The PROVIDER checks only non-emptiness. This module adds a shape check.
  # Empty means ANY port.
}

variable "destination_port_ranges" {
  type    = list(string)
  default = []
  # Usually the argument that matters -- high-risk destination ports are the
  # feature's headline use case.
}

variable "sources" {
  type = list(object({
    address_prefix      = string
    address_prefix_type = string # "IPPrefix" | "ServiceTag"
  }))
  default = []
  # The PROVIDER does not check the prefix against the type. This module
  # refuses a service tag labelled IPPrefix. Empty means ANY source.
}

variable "destinations" { }  # identical in shape and in what is unchecked

variable "description" {
  type    = string
  default = null
  # The provider refuses an EMPTY STRING while accepting omission.
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
}

This is the resource that outranks network security groups. Microsoft documents security admin rules as always having higher priority than network security group rules and therefore evaluated first. Allow passes matching traffic on for network security group evaluation; Deny and AlwaysAllow end the evaluation there, so the network security group is never consulted at all. A rule written here can block traffic a team has explicitly permitted and deliver traffic they have explicitly denied, and they cannot override back.

So the action is emitted as four derived flags rather than one string. The three values differ in more than severity, and action = "AlwaysAllow" conveys nothing about overridden network security groups to a reviewer who does not already know the model. overrides_a_denying_network_security_group does, and it is the one worth a policy check: it is the single action that can widen access from a central configuration.

And the action is not force-new. Flipping a rule's effect is an in-place update — a plan line reading "1 to change" while traffic across every virtual network the collection reaches starts being blocked, or starts bypassing every network security group in its path.

Two checks are added beyond the provider, both for shapes the caller either has right or has wrong. Port entries must look like a port or a range, because the provider validates only non-emptiness and "http" otherwise reaches Azure. And an IPPrefix must contain a digit, because the provider does not check the prefix against its type and a service tag labelled IPPrefix fails at apply. Nothing else is invented: ports are not range-checked against 0–65535 because Azure owns that limit, and prefixes are not parsed as CIDR because the field legitimately accepts IPv4, IPv6 and bare addresses.

Two facts are reported rather than enforced, deliberately. The three unsupported service tags are Microsoft's list and it may change, so refusing one that later becomes supported would reject legal input. And the high-risk destination ports are reported to confirm intent — restricting them centrally is the feature's headline use case, so the flag is only alarming in combination with an AlwaysAllow.

Five limits are emitted as constants, because each is a gap between what a rule appears to cover and what it enforces. The collection owns the blast radius and can widen it without this rule changing; sibling rules and their priorities are invisible; private endpoints in managed virtual networks are not covered; several gateway subnet types are exempt; and rules reach only networks the manager manages. None is derivable from this resource's inputs, and each has surprised somebody.

Nothing is enforced until the configuration is deployed, and enforcement is eventually consistent afterwards — including for resources created in the targeted networks later.

The destroy is forced, and that is worth separating from its consequence. The provider hard-codes the service's force flag with no argument to disable it, and the Azure CLI defaults the same flag to false. So a terraform destroy does not fail on a rule belonging to a deployed configuration — it removes it, and Azure runs a background cleanup deployment first. Microsoft's teardown checklist prescribes undeploying before deleting any rule; the forced delete bypasses that. In the plan this is one resource destroyed; in the estate it is this rule ceasing to apply across every network the collection reaches, with the network security groups it was overriding taking effect again.

lifecycle is not valid inside a module block, so a caller cannot add prevent_destroy here. On a rule that is somebody's guardrail, that is worth knowing.

🔒 The question here is not a setting on this resource. It is which action, at what priority, reaching which networks — and only the first two are visible from here.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module by tag — ?ref=v1.0.0 — never a branch.

Plan-only: this repository performs no cloud apply. A human applies from CI — and for this resource, after someone has read the action, the priority, and the collection's group list.

What terraform validate covers, offline and without credentials:

• A non-empty name, and the anchored collection ID check at both ends.
• All three enums, case-sensitively — including AlwaysAllow versus "Always allow".
• The priority range and whole-number rule.
• The port shape, which the provider does not check.
• The prefix-versus-type mismatch, which the provider does not check.
• The description non-empty rule, mirroring the provider.

What only terraform plan exercises (credentials required):

• That the collection exists, and the import guard if a rule of this name is in it.

What only terraform apply reveals:

• Whether a service tag is one of the three unsupported here — though this module reports it first.
• Whether a port value Azure rejects slipped past the shape check.

What nothing reveals at all:

• The other rules in the collection and their priorities.
• Which virtual networks the rule reaches.
• Whether the configuration has been deployed, and therefore whether any of this is enforced.

ℹ️ terraform console fires root-module variable validations, unlike terraform validate on a calling configuration. It is the honest offline harness for the first list and for every derived flag — including one fixture per branch of all three action flags, both branches of each wildcard, and the matches_everything_in_its_direction combination broken by each of its five conditions in turn.

Outputs:

id                                                  = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-network-eastus/providers/Microsoft.Network/networkManagers/nm-corp/securityAdminConfigurations/sac-baseline/ruleCollections/rc-high-risk-ports/rules/deny-rdp-inbound"
admin_rule_collection_name                          = "rc-high-risk-ports"
security_admin_configuration_name                   = "sac-baseline"
network_manager_name                                = "nm-corp"
action                                              = "Deny"
terminates_evaluation_before_network_security_groups = true
overrides_an_allowing_network_security_group        = true
leaves_network_security_groups_in_play              = false
priority                                            = 100
matches_everything_in_its_direction                 = false
service_tags_used                                   = [
  "Internet",
]
unsupported_service_tags_used                       = []
high_risk_destination_ports_matched                 = [
  "3389",
]

ℹ️ Read the two true lines together. This rule blocks inbound RDP from the internet and a network security group permitting it has no effect — which is the point, and which the action string alone does not say.

• azurerm_network_manager_admin_rule — provider reference
• Security admin rules in Azure Virtual Network Manager — the evaluation model, the three actions, the unsupported service tags and the exempt subnets
• Azure network security groups overview — how admin rules and NSG rules interact
• Sibling modules: terraform-azurerm-network-manager-admin-rule-collection, terraform-azurerm-network-manager, terraform-azurerm-network-security-group, terraform-azurerm-resource-group
• This module's SCOPE.md — the cross-module contract

💙 "Infrastructure as Code should be standardized, consistent, and secure."