You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: "Network Groups in Azure Virtual Network Manager"
3
-
description: Discover network groups in Azure Virtual Network Manager, their static and dynamic memberships, and how they simplify managing virtual networks.
2
+
title: "What is a network group in Azure Virtual Network Manager?"
3
+
description: Learn about how Network groups can help you manage your virtual networks.
4
4
author: mbender-ms
5
5
ms.author: mbender
6
6
ms.service: azure-virtual-network-manager
7
7
ms.topic: concept-article
8
-
ms.date: 05/06/2025
8
+
ms.date: 03/23/2024
9
9
---
10
10
11
-
# Network Groups in Azure Virtual Network Manager
11
+
# What is a network group in Azure Virtual Network Manager?
12
12
13
-
This article explains *network groups*in Azure Virtual Network Manager, showing how they simplify virtual network management. It also covers *static* and *dynamic group memberships* and their use cases.
13
+
In this article, you learn about *network groups*and how they can help you group virtual networks together for easier management. Also, you learn about *Static group membership* and *Dynamic group membership* and how to use each type of membership.
14
14
15
-
## Overview of network groups
15
+
## Network group
16
16
17
-
A *network group* is a global container that includes a set of virtual network resources from any region. Configurations are applied to target the network group, which then applies the configuration to all members of the group.
17
+
A *network group* is global container that includes a set of virtual network resources from any region. Then, configurations are applied to target the network group, which applies the configuration to all members of the group.
18
18
19
-
## Group membership types for network groups
19
+
## Group membership
20
20
21
-
Group membership is a many-to-many relationship, such that one group holds many virtual networks, and any given virtual network can participate in multiple network groups. As part of a network group, the virtual network receives any configurations applied to the group and deployed to the virtual network's region.
21
+
Group membership is a many-to-many relationship, such that one group holds many virtual networks and any given virtual network can participate in multiple network groups. As part of a network group, the virtual network receives any configurations applied to the group and deployed to the virtual networks region.
22
22
23
-
### Static membership of network groups
23
+
A virtual network can be set to join a network group in multiple ways. The two types are group memberships are *static* and *dynamic* memberships.
24
24
25
-
Static membership allows you to explicitly add virtual networks to a group by manually selecting individual virtual networks. The list of virtual networks is dependent on the scope (management group or subscription) defined at the time of the Azure Virtual Network Manager deployment. This method is useful when you have a few virtual networks to add to the network group. Static membership also allows you to 'patch' the network group contents by adding or removing a virtual network from the group.
25
+
### Static membership
26
26
27
-
### Dynamic membership in network groups
27
+
Static membership allows you to explicitly add virtual networks to a group by manually selecting individual virtual networks. The list of virtual networks is dependent on the scope (management group or subscription) defined at the time of the Azure Virtual Network Manager deployment. This method is useful when you have a few virtual networks you want to add to the network group. Static membership also allows you to 'patch' the network group contents by adding or removing a virtual network from the group.
28
28
29
-
Dynamic membership gives you the flexibility of selecting multiple virtual networks at scale if they meet the conditional statements you defined in Azure Policy. This membership type is useful for scenarios where you have a large number of virtual networks or if membership is dictated by a condition instead of an explicit list. Learn more about [how Azure Policy works with Network Groups](concept-azure-policy-integration.md).
29
+
### Dynamic membership
30
30
31
-
### Membership visibility in Azure Resource Graph
31
+
Dynamic membership gives you the flexibility of selecting multiple virtual networks at scale if they meet the conditional statements you defined in Azure Policy. This membership type is useful for scenarios where you have large number of virtual networks, or if membership is dictated by a condition instead of an explicit list. Learn about [How Azure Policy works with Network Groups](concept-azure-policy-integration.md).
32
32
33
-
All group membership is recorded in Azure Resource Graph and available for your use. Each virtual network receives a single entry in the graph. This entry specifies all the groups the virtual network is a member of and what contributing sources are responsible for that membership, such as static members or various policy resources. Learn how to [view applied configurations for network group membership](how-to-view-applied-configurations.md#network-group-membership).
33
+
### Membership visibility
34
34
35
-
## Network Groups and Azure Policy Integration
35
+
All group membership is recorded in Azure Resource Graph and available for your use. Each virtual network receives a single entry in the graph. This entry specifies all the groups the virtual network is a member of, and what contributing sources are responsible for that membership, such as static members or various policy resources. Learn how to [view applied configurations](how-to-view-applied-configurations.md#network-group-membership).
36
+
37
+
## Network groups and Azure Policy
36
38
37
39
When you create a network group, an Azure Policy is created so that Azure Virtual Network Manager gets notified about changes made to virtual network membership.
38
40
@@ -41,25 +43,11 @@ To create, edit, or delete Azure Virtual Network Manager dynamic group policies,
41
43
- Read and write role-based access control permissions to the underlying policy.
42
44
- Role-based access control permissions to join the network group (Classic Admin authorization isn't supported).
43
45
44
-
For more information on required permissions for Azure Virtual Network Manager dynamic group policies, review [required permissions for Azure Policy integration](concept-azure-policy-integration.md#required-permissions).
45
-
46
-
## Frequently Asked Questions (FAQ)
47
-
48
-
### What is the difference between static and dynamic membership in network groups?
49
-
50
-
Static membership requires manually adding virtual networks to a group, while dynamic membership uses Azure Policy to automatically include virtual networks based on defined conditions.
51
-
52
-
### Can a virtual network belong to multiple network groups?
53
-
54
-
Yes, a virtual network can belong to multiple network groups, and it receives configurations from all the groups it's a member of.
55
-
56
-
### How can I view the network groups a virtual network belongs to?
57
-
58
-
You can use Azure Resource Graph to view all the network groups a virtual network belongs to, along with the contributing sources for its membership.
46
+
For more information on required permissions for Azure Virtual Network Manager dynamic group policies, review [required permissions](concept-azure-policy-integration.md#required-permissions).
59
47
60
-
## Next Steps
48
+
## Next steps
61
49
62
-
- Create an [Azure Virtual Network Manager](create-virtual-network-manager-portal.md) instance using the Azure portal.
63
-
- Learn how to create a [Hub and Spoke topology with Azure Virtual Network Manager](how-to-create-hub-and-spoke.md).
64
-
- Learn how to block network traffic with a [Security admin configuration](how-to-block-network-traffic-portal.md).
65
-
- Review [Azure Policy basics](../governance/policy/overview.md) to understand how policies integrate with network groups.
50
+
- Create an [Azure Virtual Network Manager](create-virtual-network-manager-portal.md) instance using the Azure portal
51
+
- Learn how to create a [Hub and spoke topology](how-to-create-hub-and-spoke.md) with Azure Virtual Network Manager
52
+
- Learn how to block network traffic with a [Security admin configuration](how-to-block-network-traffic-portal.md)
0 commit comments