Question

Contoso runs three VNets (Prod-A, Prod-B, Prod-C) that must all communicate directly with each other. A network engineer configures a mesh network group in Azure Virtual Network Manager and deploys the connectivity configuration. Afterward, VMs in Prod-A can reach Prod-B and Prod-C, but a subnet named 'AzureFirewallSubnet' in Prod-C is unexpectedly participating in the mesh. The engineer wants the mesh to apply to all current and future VNets added to the group, without manually editing membership each time. Which combination best meets these requirements?

Accepted Answer

Use a dynamic network group membership defined with Azure Policy conditions; subnet-level exclusions are not controlled by the connectivity configuration, so no special mesh setting removes AzureFirewallSubnet

Answer

Use a dynamic network group membership defined with Azure Policy conditions, and rely on the fact that mesh connectivity automatically excludes reserved subnets like AzureFirewallSubnet

Answer

Use a static network group and add each VNet manually, then create user-defined routes to block traffic to AzureFirewallSubnet

Answer

Convert the mesh to a hub-and-spoke topology so that spoke subnets are automatically isolated from one another