Encryption at host protects data processed on the host according to Azure feature capabilities. In this case, a VM has managed identity enabled but cannot read a vault secret. “Enable encryption at host when supported by the VM and region” would not satisfy that requirement; the supported action is “Grant the identity the relevant Key Vault data-plane permission”. Managed identity issuance alone does not authorize secret access.

Different encryption mechanisms protect different parts of VM storage processing. In this case, a VM has managed identity enabled but cannot read a vault secret. “Encryption at host versus disk server-side encryption scope” would not satisfy that requirement; the supported action is “Grant the identity the relevant Key Vault data-plane permission”. Managed identity issuance alone does not authorize secret access.

Image versions provide controlled reusable artifacts for VM deployment. In this case, a VM has managed identity enabled but cannot read a vault secret. “Publish versioned images through Azure Compute Gallery” would not satisfy that requirement; the supported action is “Grant the identity the relevant Key Vault data-plane permission”. Managed identity issuance alone does not authorize secret access.

Administrative move scope and physical regional relocation are distinct operations. In this case, a VM must encrypt cached temporary and host-level storage in supported scenarios. “Moving resource groups does not itself migrate the VM's region” would not satisfy that requirement; the supported action is “Enable encryption at host when supported by the VM and region”. Encryption at host protects data processed on the host according to Azure feature capabilities.

Regional moves can require coordinated migration of VM dependencies. In this case, a VM must encrypt cached temporary and host-level storage in supported scenarios. “Azure Resource Mover or a supported workload migration process” would not satisfy that requirement; the supported action is “Enable encryption at host when supported by the VM and region”. Encryption at host protects data processed on the host according to Azure feature capabilities.

Managed identity issuance alone does not authorize secret access. In this case, a VM must encrypt cached temporary and host-level storage in supported scenarios. “Grant the identity the relevant Key Vault data-plane permission” would not satisfy that requirement; the supported action is “Enable encryption at host when supported by the VM and region”. Encryption at host protects data processed on the host according to Azure feature capabilities.

Managed identity issuance alone does not authorize secret access. In this case, an administrator turns on managed disk SSE and assumes host cache is covered identically. “Grant the identity the relevant Key Vault data-plane permission” would not satisfy that requirement; the supported action is “Encryption at host versus disk server-side encryption scope”. Different encryption mechanisms protect different parts of VM storage processing.

Managed identities provide Azure-hosted credential flows for supported services. In this case, an administrator turns on managed disk SSE and assumes host cache is covered identically. “A system-assigned or user-assigned managed identity” would not satisfy that requirement; the supported action is “Encryption at host versus disk server-side encryption scope”. Different encryption mechanisms protect different parts of VM storage processing.

Administrative move scope and physical regional relocation are distinct operations. In this case, an administrator turns on managed disk SSE and assumes host cache is covered identically. “Moving resource groups does not itself migrate the VM's region” would not satisfy that requirement; the supported action is “Encryption at host versus disk server-side encryption scope”. Different encryption mechanisms protect different parts of VM storage processing.

Encryption at host protects data processed on the host according to Azure feature capabilities. In this case, a VM needs to be moved to a different region with minimal manual recreation. “Enable encryption at host when supported by the VM and region” would not satisfy that requirement; the supported action is “Azure Resource Mover or a supported workload migration process”. Regional moves can require coordinated migration of VM dependencies.

Route tables can direct flows via approved network virtual appliances. In this case, a VM needs to be moved to a different region with minimal manual recreation. “A user-defined route directing appropriate subnet traffic to the firewall next hop” would not satisfy that requirement; the supported action is “Azure Resource Mover or a supported workload migration process”. Regional moves can require coordinated migration of VM dependencies.

An NSG filters traffic but does not itself redirect traffic to a firewall. In this case, a VM needs to be moved to a different region with minimal manual recreation. “A suitable routing design for the forced next hop” would not satisfy that requirement; the supported action is “Azure Resource Mover or a supported workload migration process”. Regional moves can require coordinated migration of VM dependencies.

Encryption at host protects data processed on the host according to Azure feature capabilities. In this case, a VM resource-group move is proposed as a way to change its physical Azure region. “Enable encryption at host when supported by the VM and region” would not satisfy that requirement; the supported action is “Moving resource groups does not itself migrate the VM's region”. Administrative move scope and physical regional relocation are distinct operations.

Route tables can direct flows via approved network virtual appliances. In this case, a VM resource-group move is proposed as a way to change its physical Azure region. “A user-defined route directing appropriate subnet traffic to the firewall next hop” would not satisfy that requirement; the supported action is “Moving resource groups does not itself migrate the VM's region”. Administrative move scope and physical regional relocation are distinct operations.

An NSG filters traffic but does not itself redirect traffic to a firewall. In this case, a VM resource-group move is proposed as a way to change its physical Azure region. “A suitable routing design for the forced next hop” would not satisfy that requirement; the supported action is “Moving resource groups does not itself migrate the VM's region”. Administrative move scope and physical regional relocation are distinct operations.

Azure NSG allow rules do not override a closed guest firewall. In this case, a VM requires controlled outbound traffic through a central firewall. “Guest operating-system firewall and service listener in addition to Azure networking” would not satisfy that requirement; the supported action is “A user-defined route directing appropriate subnet traffic to the firewall next hop”. Route tables can direct flows via approved network virtual appliances.

Inbound Azure security allows are necessary but not sufficient for guest service connectivity. In this case, a VM requires controlled outbound traffic through a central firewall. “Verify guest firewall, RDP service and effective network path” would not satisfy that requirement; the supported action is “A user-defined route directing appropriate subnet traffic to the firewall next hop”. Route tables can direct flows via approved network virtual appliances.

Administrative move scope and physical regional relocation are distinct operations. In this case, a VM requires controlled outbound traffic through a central firewall. “Moving resource groups does not itself migrate the VM's region” would not satisfy that requirement; the supported action is “A user-defined route directing appropriate subnet traffic to the firewall next hop”. Route tables can direct flows via approved network virtual appliances.

Inbound Azure security allows are necessary but not sufficient for guest service connectivity. In this case, an admin only attaches an NSG and expects all Internet traffic to traverse a central firewall. “Verify guest firewall, RDP service and effective network path” would not satisfy that requirement; the supported action is “A suitable routing design for the forced next hop”. An NSG filters traffic but does not itself redirect traffic to a firewall.

Azure NSG allow rules do not override a closed guest firewall. In this case, an admin only attaches an NSG and expects all Internet traffic to traverse a central firewall. “Guest operating-system firewall and service listener in addition to Azure networking” would not satisfy that requirement; the supported action is “A suitable routing design for the forced next hop”. An NSG filters traffic but does not itself redirect traffic to a firewall.

Administrative move scope and physical regional relocation are distinct operations. In this case, an admin only attaches an NSG and expects all Internet traffic to traverse a central firewall. “Moving resource groups does not itself migrate the VM's region” would not satisfy that requirement; the supported action is “A suitable routing design for the forced next hop”. An NSG filters traffic but does not itself redirect traffic to a firewall.

Route tables can direct flows via approved network virtual appliances. In this case, a Windows VM is unreachable because the guest OS firewall blocks RDP. “A user-defined route directing appropriate subnet traffic to the firewall next hop” would not satisfy that requirement; the supported action is “Guest operating-system firewall and service listener in addition to Azure networking”. Azure NSG allow rules do not override a closed guest firewall.

An NSG filters traffic but does not itself redirect traffic to a firewall. In this case, a Windows VM is unreachable because the guest OS firewall blocks RDP. “A suitable routing design for the forced next hop” would not satisfy that requirement; the supported action is “Guest operating-system firewall and service listener in addition to Azure networking”. Azure NSG allow rules do not override a closed guest firewall.

Guest application logs may never be generated if OS boot fails. In this case, a Windows VM is unreachable because the guest OS firewall blocks RDP. “Use platform boot diagnostics to inspect pre-application startup” would not satisfy that requirement; the supported action is “Guest operating-system firewall and service listener in addition to Azure networking”. Azure NSG allow rules do not override a closed guest firewall.

An NSG filters traffic but does not itself redirect traffic to a firewall. In this case, a VM has NSG TCP 3389 allowed, yet RDP cannot connect. “A suitable routing design for the forced next hop” would not satisfy that requirement; the supported action is “Verify guest firewall, RDP service and effective network path”. Inbound Azure security allows are necessary but not sufficient for guest service connectivity.

Route tables can direct flows via approved network virtual appliances. In this case, a VM has NSG TCP 3389 allowed, yet RDP cannot connect. “A user-defined route directing appropriate subnet traffic to the firewall next hop” would not satisfy that requirement; the supported action is “Verify guest firewall, RDP service and effective network path”. Inbound Azure security allows are necessary but not sufficient for guest service connectivity.

Guest application logs may never be generated if OS boot fails. In this case, a VM has NSG TCP 3389 allowed, yet RDP cannot connect. “Use platform boot diagnostics to inspect pre-application startup” would not satisfy that requirement; the supported action is “Verify guest firewall, RDP service and effective network path”. Inbound Azure security allows are necessary but not sufficient for guest service connectivity.

Direct public management exposure increases attack surface and is often avoidable. In this case, a compute team wants to monitor VM boot failures before logging in. “Connect through Azure Bastion or approved private network instead” would not satisfy that requirement; the supported action is “Enable boot diagnostics and review serial console or screenshots as supported”. Boot diagnostics provide visibility into early startup problems.

Private administration avoids unnecessary public management endpoints. In this case, a compute team wants to monitor VM boot failures before logging in. “Use an approved private access path such as Bastion or VPN” would not satisfy that requirement; the supported action is “Enable boot diagnostics and review serial console or screenshots as supported”. Boot diagnostics provide visibility into early startup problems.

Inbound Azure security allows are necessary but not sufficient for guest service connectivity. In this case, a compute team wants to monitor VM boot failures before logging in. “Verify guest firewall, RDP service and effective network path” would not satisfy that requirement; the supported action is “Enable boot diagnostics and review serial console or screenshots as supported”. Boot diagnostics provide visibility into early startup problems.

Private administration avoids unnecessary public management endpoints. In this case, a Linux VM fails before SSH starts. “Use an approved private access path such as Bastion or VPN” would not satisfy that requirement; the supported action is “Use platform boot diagnostics to inspect pre-application startup”. Guest application logs may never be generated if OS boot fails.

Inbound Azure security allows are necessary but not sufficient for guest service connectivity. In this case, a Linux VM fails before SSH starts. “Verify guest firewall, RDP service and effective network path” would not satisfy that requirement; the supported action is “Use platform boot diagnostics to inspect pre-application startup”. Guest application logs may never be generated if OS boot fails.

Direct public management exposure increases attack surface and is often avoidable. In this case, a Linux VM fails before SSH starts. “Connect through Azure Bastion or approved private network instead” would not satisfy that requirement; the supported action is “Use platform boot diagnostics to inspect pre-application startup”. Guest application logs may never be generated if OS boot fails.