Set-DiskNetworkAccess

Manages NetworkAccessPolicy and PublicNetworkAccess on all managed disks (OS + data) attached to Azure VMs.

Features

• Three actions: Disable (DenyAll/Disabled), Enable (AllowAll/Enabled), Report (read-only).
• Two modes: batch (CSV) for bulk operations, interactive for single VMs.
• Parallel processing: subscription groups run concurrently via ForEach-Object -Parallel (configurable ThrottleLimit).
• Batch API optimisation: VMs and disks are fetched per resource group rather than individually, drastically reducing API calls.
• Skip-compliant: disks already in the desired state are skipped — no unnecessary writes.
• Ephemeral resource handling: gracefully skips VMs and disks that no longer exist (e.g. Databricks workers).
• Structured output: every disk produces a PSCustomObject with Subscription, ResourceGroup, VM, Disk, Action, Status, NetworkAccessPolicy, PublicNetworkAccess, Detail — pipe to Export-Csv, Where-Object, etc.
• SupportsShouldProcess: full -WhatIf and -Confirm support.
• Progress & summary: Write-Progress during execution, per-subscription and overall summary tables at completion.

Requirements

Requirement	Minimum
PowerShell	7.0
Az.Accounts	latest
Az.Compute	latest
Azure login	Connect-AzAccount before running

Parameters

Parameter	Set	Required	Description
-CsvPath	Csv	Yes	Path to a CSV file with columns: SubscriptionName, ResourceGroupName, VMName, Action.
-SubscriptionName	Interactive / ReportInteractive	Yes	Azure subscription name.
-ResourceGroupName	Interactive / ReportInteractive	Yes	Resource group containing the VM.
-VMName	Interactive / ReportInteractive	Yes	Virtual machine name.
-Action	Interactive	Yes	Enable, Disable, or Report.
-ReportOnly	ReportInteractive	Yes	Report current state without requiring -Action.
-ThrottleLimit	Csv	No	Max parallel subscriptions (1–16, default 4). Set to 1 to disable parallelism.
-WhatIf	Any	No	Preview changes without applying them.
-Verbose	Any	No	Show detailed per-disk output.

CSV Format

SubscriptionName,ResourceGroupName,VMName,Action
MySubscription,MyResourceGroup,MyVM01,Disable
MySubscription,MyResourceGroup,MyVM02,Enable
OtherSubscription,OtherRG,OtherVM,Report

• Action must be Enable, Disable, or Report (validated before execution).
• Rows are grouped by SubscriptionName for parallel processing.

Examples

Batch mode — report all VMs in a CSV

.\Set-DiskNetworkAccess.ps1 -CsvPath .\vms.csv

Batch mode — capture results for further processing

$results = .\Set-DiskNetworkAccess.ps1 -CsvPath .\vms.csv
$results | Where-Object Status -eq 'Failed' | Export-Csv failures.csv -NoTypeInformation
$results | Where-Object Status -eq 'Reported' | Format-Table VM, Disk, NetworkAccessPolicy, PublicNetworkAccess

Batch mode — preview changes (WhatIf)

.\Set-DiskNetworkAccess.ps1 -CsvPath .\vms.csv -WhatIf

Batch mode — limit concurrency

.\Set-DiskNetworkAccess.ps1 -CsvPath .\vms.csv -ThrottleLimit 2

Batch mode — verbose output

.\Set-DiskNetworkAccess.ps1 -CsvPath .\vms.csv -Verbose

Interactive mode — disable network access

.\Set-DiskNetworkAccess.ps1 -SubscriptionName "MySubscription" `
                            -ResourceGroupName "MyRG" `
                            -VMName "MyVM" `
                            -Action Disable

Interactive mode — enable network access

.\Set-DiskNetworkAccess.ps1 -SubscriptionName "MySubscription" `
                            -ResourceGroupName "MyRG" `
                            -VMName "MyVM" `
                            -Action Enable

Interactive mode — report current state

.\Set-DiskNetworkAccess.ps1 -SubscriptionName "MySubscription" `
                            -ResourceGroupName "MyRG" `
                            -VMName "MyVM" `
                            -ReportOnly

Output

Each processed disk emits a structured object:

Property	Description
Subscription	Azure subscription name
ResourceGroup	Resource group containing the disk
VM	VM name
Disk	Disk name (* if the VM itself was not found)
Action	Enable, Disable, or Report
Status	Updated, Skipped, Reported, WhatIf, or Failed
NetworkAccessPolicy	Current (or target) value: AllowAll or DenyAll
PublicNetworkAccess	Current (or target) value: Enabled or Disabled
Detail	Additional context (e.g. Already compliant, Disk not found (ephemeral or deleted))

Status values

Status	Meaning
Updated	Disk policy was changed successfully.
Skipped	Disk already compliant, or VM/disk not found (ephemeral).
Reported	Current state returned without changes (Report action).
WhatIf	Change previewed but not applied (-WhatIf mode).
Failed	An error occurred processing this disk.

Sample Summary Output

═══ Per-Subscription Summary ═══

Subscription             VMs Updated Skipped Reported WhatIf Failed Elapsed
------------             --- ------- ------- -------- ------ ------ -------
POSTE-COMMONS-PRODUZIONE   1       0       0        1      0      0 00:00:01
POSTE-CERTIFICAZIONE      32       0       0       59      0      0 00:00:04
POSTE-DIGITAL-PRODUZIONE  64       0      36      131      0      0 00:00:07
POSTE-PRODUZIONE          55       0       0      197      0      0 00:00:09
POSTE-SVILUPPO            48       0       0       89      0      0 00:00:13

═══ Overall Summary ═══
  Subscriptions  : 5 (ThrottleLimit=4)
  Total VMs      : 200
  Disks updated  : 0
  Disks skipped  : 36
  Disks reported : 477
  Disks failed   : 0
  Elapsed        : 00:00:18

Architecture

CSV input
  │
  ├─ Validate columns & Action values
  ├─ Group rows by SubscriptionName
  ├─ Pre-create Az contexts (one per subscription)
  │
  └─ ForEach-Object -Parallel (per subscription group)
       │
       ├─ Phase 1: Batch-fetch VMs per unique resource group
       ├─ Phase 2: Parse disk info from VMs, batch-fetch disks per unique RG
       └─ Phase 3: Process rows using cached data
            ├─ Report  → hashtable lookup only
            ├─ Enable  → lookup + Update-AzDisk (if non-compliant)
            └─ Disable → lookup + Update-AzDisk (if non-compliant)

Performance Notes

The batch-fetch approach replaces individual Get-AzVM and Get-AzDisk calls with bulk per-resource-group calls. For 200 VMs across 5 subscriptions this reduces ~700 individual REST calls to ~25 bulk calls, bringing execution from ~1:35 down to ~0:18 (5× speedup). The improvement scales with VM density per resource group.