Limits: What You Can't (or Shouldn't) Do

The platform is shared. These limits keep it secure, compliant and manageable for everyone.

Network

Limit	Why	What to do instead
No direct inbound traffic from the internet to your spoke	All traffic is inspected centrally	Publish web apps through the central Application Gateway with WAF (request). For SFTP to a storage account, ask for a DNAT rule (Inbound SFTP)
Outbound internet only to allowed destinations	Internet traffic goes through the central firewall	Request firewall rules for the FQDNs, IPs and ports you need
No VNet peering to other spokes or your own VPN gateways	Routing is managed in the hub	Request a firewall rule for spoke-to-spoke traffic
You can't change your VNet address range, subnets, NSGs or route tables in the portal	They are managed by the platform as code; manual changes are overwritten	Request a spoke change
Your address range comes from the central IP plan	Overlapping ranges break routing	Tell the platform team how many addresses you need
Firewall rules between production and non-production spokes are normally not allowed	Production data must not flow to environments that are not production	Use test data in non-production. Ask your security officer if you believe you need an exception.
Normally no public IP addresses on your resources	Public access goes through the Application Gateway (web) or the firewall (other protocols)	Use private endpoints and the central entry points (Design principles)
Don't change the priority of an existing NSG rule in the spoke JSON	Terraform recreates the rule, and that can fail and leave the NSG in an inconsistent state	Ask for a new rule with a new name and priority, and remove the old rule in a later change
Incoming traffic from other workloads to your spoke is denied until you agree to a rule	Rules are defined at the destination, so the owner of the destination decides who may enter	Expect to be asked for approval when another team requests access to your spoke, and give your reasons if you refuse (How it works)

Identity and access

Limit	Why	What to do instead
Access goes through the four spoke groups	Consistent, auditable access	Ask for your team's group to be added to ProductTeamGroupNames
Elevated roles may require PIM activation	Least privilege	Activate the role in PIM when you need it
Don't change the members or owners of the spoke groups yourself	They are managed by the platform	Change the members of your team's group in Entra ID

Governance

Limit	Why	What to do instead
Some Azure Policies deny deployments (for example public endpoints or missing encryption)	Security baseline	Design for private endpoints; if you really need an exception, request a policy exemption with a rationale and an end date
Required tags on the subscription: owner, department, workload, pii, costcentre, environment	Cost allocation and ownership	Keep them current; ask for a change when ownership changes
Only the prd spoke may hold production data	Data governance	Use test data in dev, tst and acc
Don't move your subscription to another management group, rename it or delete it	Placement drives the policies you get	Request a spoke change or deletion
No manual changes in production	A manual change has no history and is error-prone; in your spoke it is also overwritten if it touches the baseline	Change production only through your pipeline, reviewed by a second person (Design principles)
Don't use the baseline Key Vault, storage account or workspace for things they were not meant for	They support the spoke itself	Deploy your own with your code, and check with your platform team what the baseline resource is used for

Naming and lifecycle

Limit	Details
Workload short name: at most 6 characters, fixed for life	It is in every resource name and in the platform's state. Changing it means a new spoke.
Environment is fixed for life	dev stays dev. A new environment is a new spoke.
Regions	Only the regions the hub runs in. Adding a region to the hub is a separate request.
Deleting a spoke doesn't cancel the subscription	The platform team decommissions it separately.