Status: IN
Platform IPs `168.63.129.16` and `169.254.169.254` (DHCP, DNS, IMDS, health monitoring) are not subject to NSG rules by default but can be blocked using service tags `AzurePlatformDNS`, `AzurePlatformIMDS`, and `AzurePlatformLKM`.
Source: entries/2026/03/11/vnet-nsg.md