Status: IN
Platform IPs 168.63.129.16 and 169.254.169.254 (DHCP, DNS, IMDS, health monitoring) are exempt from NSG rules by default but can be blocked using service tags (AzurePlatformDNS, AzurePlatformIMDS, AzurePlatformLKM).
Source: entries/2026/03/11/vnet-nsg.md