OpenShift Network Security Policy Is Blocking my machine from Connecting to ARO Cluster

Question

OpenShift Network Security Policy Is Blocking my machine from Connecting to ARO Cluster

Patrick M. Kidney 0

OpenShift Network Security Policy Is Blocking my machine from Connecting to ARO Cluster. If I try to configure an Network Security rule I get access is denied even though my account has Global Admin and my account owns the tenant. How can I configure the NSG if my account is getting access is denied. Its the most stupid problem. Microsoft makes changes and now I am having all kinds of Security related issues. My tenant is complete blocked from making any changes. How can I get around this security issues

Durga Reshma Malthi 11,600 Reputation points Microsoft External Staff Moderator

2025-08-20T00:18:31.0366667+00:00

Hi Patrick M. Kidney

Are you unable to access the NSG

What is the exact error message you receive when access is denied

Have you checked whether there are any resource locks (ReadOnly/Delete) applied to the NSG or resource group
Patrick M. Kidney 0 Reputation points

2025-08-20T00:23:50.5633333+00:00

I can’t make any administrative changes. I am completely blocked from any config changes. All I want to do is connect my endpoint to azure and and run my openshift command to run container to add a rule. And it blocks me.
Anusree Nashetty 6,555 Reputation points Microsoft External Staff Moderator

2025-08-22T17:26:03.45+00:00

Hi Patrick M. Kidney

Did you get a chance to see my response. If you have any further queries, let me know. If the information is helpful, please click on Upvote.

1 answer

Your answer

Durga Reshma Malthi 11,600 Reputation points Microsoft External Staff Moderator

2025-08-20T00:18:31.0366667+00:00

Hi Patrick M. Kidney

Are you unable to access the NSG

What is the exact error message you receive when access is denied

Have you checked whether there are any resource locks (ReadOnly/Delete) applied to the NSG or resource group
Patrick M. Kidney 0 Reputation points

2025-08-20T00:23:50.5633333+00:00

I can’t make any administrative changes. I am completely blocked from any config changes. All I want to do is connect my endpoint to azure and and run my openshift command to run container to add a rule. And it blocks me.
Anusree Nashetty 6,555 Reputation points Microsoft External Staff Moderator

2025-08-22T17:26:03.45+00:00

Hi Patrick M. Kidney

Did you get a chance to see my response. If you have any further queries, let me know. If the information is helpful, please click on Upvote.

Answer 1

Hi Patrick M. Kidney

Your issue arises because Azure Red Hat OpenShift (ARO) resource groups are locked down by design. To manage NSGs, you must attach your own during cluster creation—on existing clusters, NSG changes in managed groups are blocked, and full control usually requires redeployment.

When you create an ARO cluster, Azure automatically creates a dedicated "Managed Resource Group" for cluster resources (VMs, NSGs, etc.). This group has a DenyAssignment, meaning even users with Global Admin or Tenant Owner roles are prevented from making changes such as editing NSG rules or adding users inside this resource group.
https://access.redhat.com/solutions/7024799

Only the Cluster Service Principal is excluded from the deny assignment; all other users, including admins, are blocked. This strict control is designed to maintain cluster integrity and security but often becomes a major headache when you need to troubleshoot or customize.
https://learn.microsoft.com/en-us/azure/openshift/howto-bring-nsg

Use “Bring Your Own NSG” Feature: If you use your own NSG from your own resource group (not the managed one), you retain the ability to add or change rules as you like. Future changes should be done through this NSG, not the cluster’s managed NSGs.

You cannot modify the NSG in the Managed Resource Group due to DenyAssignment. If you need to make changes, you may have to Re-deploy ARO with the "Bring Your Own NSG" feature, ensuring your custom NSG is attached during setup.

If you have any further queries, let me know. If the information is helpful, please click on Upvote.