How to Change Your Spoke¶
Your spoke's baseline is defined in a file the platform team manages. To change it, send a request with only the fields that change. You don't need to know the file format.
What you can change¶
| Change | Notes |
|---|---|
| Add a subnet | Name, size, delegations, service endpoints |
| Change delegations or service endpoints of a subnet | |
| Add or change NSG rules | Source, destination, port, protocol, allow/deny |
| Add a route table or routes | |
| Give another team access | Their Entra ID group display name |
| Change PIM behavior per role | Direct, PIM self-approve, PIM with approval |
| Change tags | For example a new owner or cost centre |
| Move to another management group | For example from non-production to production policies |
| Rename the subscription | |
| Add a region | Only regions the hub runs in |
| Switch the Azure DevOps service connection to federated credentials |
Changing NSG rules¶
You can ask for a new NSG rule or a changed one. One thing to know:
Don't change the priority of an existing NSG rule
Changing the priority of an existing rule makes the platform recreate that rule, and the recreation can fail and leave the NSG in an inconsistent state. Ask for a new rule with a new name and a new priority instead. When the new rule works, ask for the old rule to be removed.
Name the subnet or NSG, the direction, the source and destination, the port, the protocol and whether the rule allows or denies. Traffic that leaves your VNet is also checked by the hub firewall, so you may need a firewall rule as well. If you change subnets, see IP range and subnets.
What you can't change¶
| Change | Why | Alternative |
|---|---|---|
| The workload short name or environment | They identify the spoke | Request a new spoke and migrate |
| Resize a subnet that has resources in it | Azure doesn't allow it | Add a new subnet and move resources |
| Owners of the spoke groups after creation | They are fixed at creation | Change the members of your team group, or ask for another team group |
Changes you make yourself¶
Inside your subscription, you deploy and change your own resources with your own pipelines or the portal, within the limits. You don't need a request for that.
Change the members of your team's Entra ID group yourself (or through your identity team): that changes who has access, without a platform change.