Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
Sorry, I can't help with this. Please make a new request or share your feedback.
Request for Investigation: Missing VNet Tag Disabled Security Admin Rule
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 47%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELS%3C/text%3E%3C/svg%3E)
Lianpeng Sun
80
Reputation points Microsoft Employee
Hi Support Team,
We identified the likely root cause of our connectivity issue: a required tag on the VNet was removed, which appears to have disabled the related rule in Security Admin Configuration.
Details:
- Tag: MAI-PortBlock-ExemptHTTPS:MSASG.Compliance_Engineering.9395581
- VNet: MPHP_INT-vnet Azure link: https://portal.azure.com/#@mspmecloud.onmicrosoft.com/resource/subscriptions/400b141f-9ce9-4189-b402-95f406803193/resourceGroups/MPHP_INT/providers/Microsoft.Network/virtualNetworks/MPHP_INT-vnet/overview
- Tenant: pme tenant
- Note: We do not have sufficient permissions to add this tag back ourselves.
Could you please help with the following:
- Confirm when this VNet tag was removed and by which identity (user/SPN/automation).
- Confirm whether the tag removal directly caused the Security Admin Configuration rule to be disabled.
- Re-apply the required tag and restore the expected Security Admin Configuration behavior (or advise exact remediation steps).
- Share preventive recommendations (for example, policy/lock/audit alert) to prevent recurrence.
Impact observed:
- Domain access to internal services failed due to blocked network path.
Please let us know if additional timestamps or correlation details are needed.Hi Support Team,
We identified the likely root cause of our connectivity issue: a required tag on the VNet was removed, which appears to have disabled the related rule in Security Admin Configuration.
Details:
- Tag: MAI-PortBlock-ExemptHTTPS:MSASG.Compliance_Engineering.9395581
- VNet: MPHP_INT-vnet
Azure link: https://portal.azure.com/#@mspmecloud.onmicrosoft.com/resource/subscriptions/400b141f-9ce9-4189-b402-95f406803193/resourceGroups/MPHP_INT/providers/Microsoft.Network/virtualNetworks/MPHP_INT-vnet/overview - Tenant: pme tenant
- Note: We do not have sufficient permissions to add this tag back ourselves.
Could you please help with the following:
- Confirm when this VNet tag was removed and by which identity (user/SPN/automation).
- Confirm whether the tag removal directly caused the Security Admin Configuration rule to be disabled.
- Re-apply the required tag and restore the expected Security Admin Configuration behavior (or advise exact remediation steps).
- Share preventive recommendations (for example, policy/lock/audit alert) to prevent recurrence.
Impact observed:
- Domain access to internal services failed due to blocked network path.
Please let us know if additional timestamps or correlation details are needed.
Azure Virtual Network
Answer accepted by question author
AI answer
AI-generated content may be incorrect. Read our transparency notes for more information.