Network Watchers - Verify IP Flow

Service:

Network Watcher

API Version:

2026-01-01

Verify IP flow from the specified VM to a location given the currently configured NSG rules.

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/networkWatchers/{networkWatcherName}/ipFlowVerify?api-version=2026-01-01

URI Parameters

Name	In	Required	Type	Description
networkWatcherName	path	True	string	The name of the network watcher.
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Required	Type	Description
direction	True	Direction	The direction of the packet represented as a 5-tuple.
localIPAddress	True	string	The local IP address. Acceptable values are valid IPv4 addresses.
localPort	True	string	The local port. Acceptable values are a single integer in the range (0-65535). Support for * for the source port, which depends on the direction.
protocol	True	IpFlowProtocol	Protocol to be verified on.
remoteIPAddress	True	string	The remote IP address. Acceptable values are valid IPv4 addresses.
remotePort	True	string	The remote port. Acceptable values are a single integer in the range (0-65535). Support for * for the source port, which depends on the direction.
targetResourceId	True	string	The ID of the target resource to perform next-hop on.
targetNicResourceId		string	The NIC ID. (If VM has multiple NICs and IP forwarding is enabled on any of them, then this parameter must be specified. Otherwise optional).

Responses

Name	Type	Description
200 OK	VerificationIPFlowResult	Azure operation completed successfully.
202 Accepted	VerificationIPFlowResult	The request has been accepted for processing, but processing has not yet completed. Headers Location: string Retry-After: integer
Other Status Codes	ErrorResponse	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Ip flow verify

Sample request

HTTP

POST https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/networkWatchers/nw1/ipFlowVerify?api-version=2026-01-01

{
  "direction": "Outbound",
  "localIPAddress": "10.2.0.4",
  "localPort": "80",
  "remoteIPAddress": "121.10.1.1",
  "remotePort": "80",
  "targetResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Compute/virtualMachines/vm1",
  "protocol": "TCP"
}

Java

import com.azure.resourcemanager.network.models.Direction;
import com.azure.resourcemanager.network.models.IpFlowProtocol;
import com.azure.resourcemanager.network.models.VerificationIpFlowParameters;

/**
 * Samples for NetworkWatchers VerifyIpFlow.
 */
public final class Main {
    /*
     * x-ms-original-file: 2026-01-01/NetworkWatcherIpFlowVerify.json
     */
    /**
     * Sample code: Ip flow verify.
     * 
     * @param manager Entry point to NetworkManager.
     */
    public static void ipFlowVerify(com.azure.resourcemanager.network.NetworkManager manager) {
        manager.serviceClient().getNetworkWatchers().verifyIpFlow("rg1", "nw1",
            new VerificationIpFlowParameters().withTargetResourceId(
                "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Compute/virtualMachines/vm1")
                .withDirection(Direction.OUTBOUND).withProtocol(IpFlowProtocol.TCP).withLocalPort("80")
                .withRemotePort("80").withLocalIpAddress("10.2.0.4").withRemoteIpAddress("121.10.1.1"),
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Python

from azure.identity import DefaultAzureCredential

from azure.mgmt.network import NetworkManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-network
# USAGE
    python network_watcher_ip_flow_verify.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = NetworkManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.network_watchers.begin_verify_ip_flow(
        resource_group_name="rg1",
        network_watcher_name="nw1",
        parameters={
            "direction": "Outbound",
            "localIPAddress": "10.2.0.4",
            "localPort": "80",
            "protocol": "TCP",
            "remoteIPAddress": "121.10.1.1",
            "remotePort": "80",
            "targetResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Compute/virtualMachines/vm1",
        },
    ).result()
    print(response)


# x-ms-original-file: 2026-01-01/NetworkWatcherIpFlowVerify.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armnetwork_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12"
)

// Generated from example definition: 2026-01-01/NetworkWatcherIpFlowVerify.json
func ExampleWatchersClient_BeginVerifyIPFlow() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armnetwork.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewWatchersClient().BeginVerifyIPFlow(ctx, "rg1", "nw1", armnetwork.VerificationIPFlowParameters{
		Direction:        to.Ptr(armnetwork.DirectionOutbound),
		LocalIPAddress:   to.Ptr("10.2.0.4"),
		LocalPort:        to.Ptr("80"),
		RemoteIPAddress:  to.Ptr("121.10.1.1"),
		RemotePort:       to.Ptr("80"),
		TargetResourceID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Compute/virtualMachines/vm1"),
		Protocol:         to.Ptr(armnetwork.IPFlowProtocolTCP),
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	res, err := poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to poll the result: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armnetwork.WatchersClientVerifyIPFlowResponse{
	// 	VerificationIPFlowResult: armnetwork.VerificationIPFlowResult{
	// 		Access: to.Ptr(armnetwork.AccessAllow),
	// 		RuleName: to.Ptr("Rule1"),
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { NetworkManagementClient } = require("@azure/arm-network");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to verify IP flow from the specified VM to a location given the currently configured NSG rules.
 *
 * @summary verify IP flow from the specified VM to a location given the currently configured NSG rules.
 * x-ms-original-file: 2026-01-01/NetworkWatcherIpFlowVerify.json
 */
async function ipFlowVerify() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "00000000-0000-0000-0000-000000000000";
  const client = new NetworkManagementClient(credential, subscriptionId);
  const result = await client.networkWatchers.verifyIPFlow("rg1", "nw1", {
    direction: "Outbound",
    localIPAddress: "10.2.0.4",
    localPort: "80",
    remoteIPAddress: "121.10.1.1",
    remotePort: "80",
    targetResourceId:
      "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Compute/virtualMachines/vm1",
    protocol: "TCP",
  });
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

{
  "access": "Allow",
  "ruleName": "Rule1"
}

Status code:

202

Location: https:/management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/networkWatchers/nw1/ipFlowVerify?api-version=2025-07-01

{
  "access": "Allow",
  "ruleName": "Rule1"
}

Definitions

Name	Description
Access	Access to be allowed or denied.
Direction	The direction of the traffic.
ErrorDetails	Common error details representation.
ErrorResponse	The error object.
IpFlowProtocol	Protocol to be verified on.
VerificationIPFlowParameters	Parameters that define the IP flow to be verified.
VerificationIPFlowResult	Results of IP flow verification on the target resource.

Access

Enumeration

Access to be allowed or denied.

Value	Description
Allow	Allow
Deny	Deny

Direction

Enumeration

The direction of the traffic.

Value	Description
Inbound	Inbound
Outbound	Outbound

ErrorDetails

Object

Common error details representation.

Name	Type	Description
code	string	Error code.
message	string	Error message.
target	string	Error target.

ErrorResponse

Object

The error object.

Name	Type	Description
error	ErrorDetails	Error The error details object.

IpFlowProtocol

Enumeration

Protocol to be verified on.

Value	Description
TCP	TCP
UDP	UDP

VerificationIPFlowParameters

Object

Parameters that define the IP flow to be verified.

Name	Type	Description
direction	Direction	The direction of the packet represented as a 5-tuple.
localIPAddress	string	The local IP address. Acceptable values are valid IPv4 addresses.
localPort	string	The local port. Acceptable values are a single integer in the range (0-65535). Support for * for the source port, which depends on the direction.
protocol	IpFlowProtocol	Protocol to be verified on.
remoteIPAddress	string	The remote IP address. Acceptable values are valid IPv4 addresses.
remotePort	string	The remote port. Acceptable values are a single integer in the range (0-65535). Support for * for the source port, which depends on the direction.
targetNicResourceId	string	The NIC ID. (If VM has multiple NICs and IP forwarding is enabled on any of them, then this parameter must be specified. Otherwise optional).
targetResourceId	string	The ID of the target resource to perform next-hop on.

VerificationIPFlowResult

Object

Results of IP flow verification on the target resource.

Name	Type	Description
access	Access	Indicates whether the traffic is allowed or denied.
ruleName	string	Name of the rule. If input is not matched against any security rule, it is not displayed.