Azure is a control-plane + data-plane factory. Entra, ARM, then the wire.

1. Why Azure is two factories

Students who just finished a NGFW lesson look for a 6-tuple and a Session Browser. Azure does not have that object. Official ARM starts with a sentence you should steal: operations divide into control plane and data plane. You create a virtual machine through the control plane. After it exists, you interact with it through data-plane operations such as RDP. You create a storage account through the control plane. You read and write blobs on the data plane, at a URI that is not management.azure.com.

Three tickets that look the same in chat — “prod is down,” “AuthorizationFailed,” “users get 403” — land on three different stations. Subscription aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee named Techclick-Lab in tenant ffffffff-1111-2222-3333-444444444444 is not the Fabrikam-Guest tab you left open. az account show is the first command because every later az monitor activity-log list and every az network nic list-effective-nsg is scoped to wherever that call landed.

Hero · the two-factory floor

Official fact students invert: even during periods of unavailability for the control plane, you can still access the data plane of your Azure resources. You can keep reading https://myaccount.blob.core.windows.net when https://management.azure.com is unhappy. The reverse is also true — a green ARM write does not mean the blob endpoint or the VM NIC accepted a packet. Features that enforce management and governance might not apply to data-plane operations. A lock that prevents users from deleting a database does not prevent users from deleting data through queries.

2. Mental model — four stations

Hold four stations in order. Interviews fail when people start at station three because Network security groups is the menu they know.

Path · identity before the hop

Entra identity answers “whose token is on this call?” Official RBAC step 1: a user or service principal acquires a token for Azure Resource Manager. The token includes group memberships, including transitive ones. If tenantId is not the ticket tenant, stop. Microsoft Entra roles (Graph) are not Azure roles (ARM). You cannot use an Entra role permission inside an Azure custom role, or the reverse.

ARM request answers “what did they ask ARM to manage?” Official: when you send a request through any Azure API, tool, or SDK, Resource Manager receives it. It authenticates and authorizes before forwarding to the resource provider. ARM automatically applies Azure RBAC, Azure Policy, management locks, and Activity Logs. Role assignment = security principal + role definition + scope. Scope is management group, subscription, resource group, or resource. Lower levels inherit from higher levels.

Activity Log answers “did the factory print a receipt, and what did it say?” Official Administrative category: every action taken by a user or application using Resource Manager is modeled as an operation on a particular resource type. Quote caller (UPN or SPN), operationName.value (for example Microsoft.Network/networkSecurityGroups/write), and status.value (Started / Succeeded / Failed). Activity log is collected automatically. A diagnostic setting only exports it for longer retention.

NSG / route + diagnostic answers “where did the packet go, and which hop dropped it?” Official inbound: Azure first processes the NSG associated with the subnet, then the NSG associated with the NIC. Both must allow. Official routing: user-defined routes override Azure default system routes. Next hop types you name in interviews: Virtual appliance, Internet, VirtualNetworkGateway, None. Diagnostic settings collect resource logs (not on by default) and can send Activity Log plus platform metrics to Log Analytics, Storage, Event Hubs, or a partner.

3. ARM evaluation vs the wire

Flowchart first. Prose second. Official RBAC evaluation is a factory line on the control plane. Official VNet inbound is a different line. You pick the line from the symptom, not from the blade you like.

On the wire, official inbound order is not the troubleshooting list you memorized. Traffic arrives at the subnet. Azure first processes the NSG associated with that subnet, if one exists. Azure then processes the NSG associated with the NIC, if one exists. To permit port 443 to the virtual machine, both NSGs must include a rule that allows it. Microsoft’s own tip: avoid associating NSGs with both a subnet and its NICs at the same time — overlapping rules are how this ticket is born. Outbound is the reverse: NIC NSG first, then subnet NSG. NSGs are stateful. You do not write a matching ephemeral outbound the way you would on an AWS NACL.

4. How to choose the station

You are not choosing a product to buy. You are choosing which factory job to read first. Pick from the table, then stay on that station until you can quote a field.

5. Runbook Side A → B → C

Concept is the four stations. Path is the two factory lines. Do is this runbook. Lab values only — tenant ffffffff-1111-2222-3333-444444444444, subscription aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee named Techclick-Lab, region eastus, caller secops@lab.example, NIC nic-app-web, NSG app-nsg, route table app-udr, partner 203.0.113.88. Nothing here is a live tenant.

Side A — name the Entra identity (building the factory badge)

Primary source: Manage Azure portal settings — Directories + subscriptions + Get subscription and tenant IDs. Console path: gear icon → Directories + subscriptions. CLI first, always.

1. Write the ticket tenant and subscription on the pad

   Directory ID, subscription name, region, and the caller the ticket claims. Lab: tenant ffffffff-1111-2222-3333-444444444444 / subscription Techclick-Lab / eastus / secops@lab.example.

2. Call az account show

   Dummy lab command (same shape as the practice dashboard):

   az-lab $ · dummy

   az account show
   {
     "id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
     "name": "Techclick-Lab",
     "tenantId": "ffffffff-1111-2222-3333-444444444444",
     "user": { "name": "secops@lab.example", "type": "user" }
   }

3. Match or stop

   If tenantId or subscription name is not the ticket, you are looking at a twin. Do not open Activity Log, do not edit an NSG, do not “fix” a UDR here. Portal: Settings → Directories + subscriptions → All Directories → Switch. Then clear Default subscription filter if the list is still empty. Official: a leftover filter hides the subscription you just found.

Side B — print the ARM receipt (the control plane)

Primary source: Activity log in Azure Monitor + Activity Log event schema + Control plane and data plane. Console path: Monitor → Activity log. Official: Administrative category records create, update, delete, and action operations performed through Resource Manager.

1. Filter Activity Log on one official operation

   For a “who changed 443?” ticket: Operation = Microsoft.Network/networkSecurityGroups/write. For a route miss: Microsoft.Network/routeTables/write. For a role change: Microsoft.Authorization/roleAssignments/write. Official: Write, Delete, or Action operations record both the start and the success or fail.

2. Read the receipt fields

   You need caller (UPN or SPN), operationName.value, status.value, authorization.scope, and claims.aud. Audience https://management.azure.com/ or https://management.core.windows.net/ is ARM. No Failed status means ARM accepted the API. It does not mean the partner’s SYN was accepted.

3. If the row is missing, ask which plane

   Official: Activity Log Administrative is ARM. A storage Get / Put hits https://myaccount.blob.core.windows.net — that is data plane. An RDP session is data plane. A SQL query is data plane. An empty Activity Log for Get Blob is not a broken monitor. You need a diagnostic setting on the storage account (resource logs), or you switch to the data-plane RBAC DataActions assignment. Activity log itself is collected automatically; a diagnostic setting only exports it for longer retention and Kusto.

{
  "caller": "secops@lab.example",
  "category": { "value": "Administrative" },
  "operationName": { "value": "Microsoft.Network/networkSecurityGroups/write" },
  "status": { "value": "Succeeded" },
  "authorization": {
    "action": "Microsoft.Network/networkSecurityGroups/write",
    "scope": "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/resourceGroups/rg-app-lab/providers/Microsoft.Network/networkSecurityGroups/app-nsg"
  },
  "claims": {
    "aud": "https://management.azure.com/",
    "http://schemas.microsoft.com/identity/claims/tenantid": "ffffffff-1111-2222-3333-444444444444",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "secops@lab.example"
  },
  "eventTimestamp": "2026-08-16T09:18:12Z",
  "correlationId": "aaaa0000-bb11-2222-33cc-444444dddddd",
  "subscriptionId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "resourceGroupName": "rg-app-lab"
}

Say the word receipt. This event proves who called ARM and which NSG they wrote. It does not prove a partner packet was accepted. Side C is the wire.

Side C — walk NSG / route, then the diagnostic (the data plane)

Primary sources: How NSGs filter traffic, Effective security rules, Virtual network traffic routing, Network Watcher next hop, Diagnostic settings. Isolate vs change-control lives on the desk. Here the rule is: do not disable the NSG to test.

1. Read the route before you blame a firewall

   Console: Network Watcher → Next hop, or NIC → Effective routes. Official: UDRs override default system routes. Dummy: az network watcher show-next-hop → nextHopType=Internet, route table app-udr. If the design said “all egress through the hub firewall,” this UDR is the miss. Next hop type should be Virtual appliance with the firewall private IP. Next hop None is a blackhole. They are not the same.

2. Read effective security rules, not “an NSG”

   Console: Virtual machines → app-web-01 → Networking → NIC → Help → Effective security rules. CLI shape: az network nic list-effective-nsg --name nic-app-web --resource-group rg-app-lab. Official inbound: subnet first, then NIC. Both must allow. Lab app-nsg: priority 100 Allow-HTTPS from 10.0.0.0/8, then 4096 DenyAll. A partner on 203.0.113.88 never matches 10/8.

3. Prove the packet with a diagnostic, not a green blade

   IP flow verify names the rule that allowed or denied. NSG / VNet flow logs carry the traffic decision. Resource logs are not collected by default — if the diagnostic setting was never created, the pipe is empty on purpose. Dummy:

   az-lab $ · dummy flow / diagnostic

   az network watcher test-ip-flow --direction Inbound --protocol TCP \
     --local 10.0.9.10 --remote 203.0.113.88 --port 443
   access=Deny rule=DenyAll
   
   # VNet / NSG flow decision (lab)
   10.0.9.10 203.0.113.88 443 T D   # D = denied

4. Change one hop, under control

   If the NIC Source is the miss, add a scoped inbound allow for 203.0.113.88/32 TCP 443 with a ticket description. Do not disable the NSG. Do not open 0.0.0.0/0 to test. Re-run IP flow verify. Partner SYN should flip from Deny to Allow. For an ARM ticket, re-read Activity Log status after you attach the missing role assignment — that proof is on the evidence desk.

Proof · receipt and flow on the same desk

6. Runtime — after the receipt prints

A successful Microsoft.Network/networkSecurityGroups/write is a control-plane event. The new allow is now in the data-plane evaluation of later packets, but the packet still walks the official layers: route table, then subnet NSG, then NIC NSG. Official compare: inbound is subnet then NIC; outbound is NIC then subnet. Default DenyAllInBound sits at priority 65500. A custom DenyAll at 4096 beats it and beats a later allow you forgot to put above it.

The ARM path never hits an NSG. The caller is secops@lab.example in tenant ffffffff-…4444. ARM assembles the token, checks deny assignments, then looks for an Action at scope. No Action → not allowed. Official RBAC is additive: Contributor at subscription plus Reader at the resource group is still Contributor on that group. A deny assignment still wins.

Storage Get Blob is the classic trap after go-live. Official ARM: you create the storage account through the control plane; you read and write data on the data plane at the storage URI. Activity Log will stay empty for the Get. Account-level calls such as creating the account or changing the firewall are ARM and will show. If the app cannot read an object, do not spend twenty minutes on Activity Log. Open the storage diagnostic (resource logs), then the data-plane RBAC assignment (DataActions), then — if the account is behind a private endpoint — the private DNS zone privatelink.blob.core.windows.net and its virtual network link. Recreating the private endpoint does not fix a missing zone.

7. Traps + proof + desk

Related: Azure evidence desk — first tool + proof field · NSG and Azure Firewall · Azure Security hub

Sources

• Azure Resource Manager — Control plane and data plane — manage vs use; management.azure.com; instance endpoints; locks do not govern queries
• What is Azure Resource Manager? — ARM receives every management request; authenticates and authorizes; four scopes
• What is Azure role-based access control — security principal, role definition, scope; token → deny assignments → Actions − NotActions
• Manage Azure resources by using the REST API — Bearer token from Entra on ARM calls
• Activity log in Azure Monitor — subscription-level events; diagnostic setting exports for longer retention
• Activity Log event schema — caller, operationName, status, authorization, claims, Administrative category
• Diagnostic settings in Azure Monitor — Activity Log collected automatically; resource logs are not
• Network security groups overview — five-tuple; allow or deny; default DenyAllInBound 65500
• How NSGs filter traffic — inbound subnet then NIC; outbound NIC then subnet; both must allow
• Effective security rules — aggregated inbound and outbound on the NIC
• Virtual network traffic routing — UDRs override system routes; next hop types
• Network Watcher next hop — nextHopType, IP, route table ID
• Portal settings — Directories + subscriptions
• Get subscription and tenant IDs
• What is Microsoft Entra ID? — identity for Azure access

Related: Azure evidence desk · NSG and Azure Firewall · Entra Conditional Access · Defender for Cloud · Key Vault secrets · Azure Security hub