{"id":"azure-platform-ips-exempt-from-nsgs","text":"Platform IPs `168.63.129.16` and `169.254.169.254` (DHCP, DNS, IMDS, health monitoring) are not subject to NSG rules by default, but can be blocked using service tags `AzurePlatformDNS`, `AzurePlatformIMDS`, and `AzurePlatformLKM`.","truth_value":"IN","source":"entries/2026/03/11/vnet-nsg.md","source_url":"","source_hash":"7770db13ddbe6897","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"azure-platform-ips-exempt-from-nsgs","truth_value":"IN","reason":"premise"}]}}