Thanks for the reply - as I mentioned in the original post - attaching an NSG without ANY rules caused the traffic to stop flowing.  I hadn't even got to the point of adding any explicit allow rules, let alone any denies! ... View more

Hi @JimmyPhelan - bit late to the party, but someone might benefit!  I achieved an automated deployment from Azure Devops using terraform that looked a bit like this: resource "azurerm_managed_application" "vmx" { name = var.application_resource_name location = var.location resource_group_name = data.azurerm_resource_group.vnet.name kind = "MarketPlace" managed_resource_group_name = var.managed_resource_group_name plan { name = "cisco-meraki-vmx" product = "cisco-meraki-vmx" publisher = "cisco" version = "18.2.11" } parameter_values = jsonencode({ lan = { value = var.lan } location = { value = var.location } vmName = { value = var.vm_name } merakiAuthToken = { value = data.azurerm_key_vault_secret.auth_token.value } zone = { value = var.zone } virtualNetworkName = { value = var.virtual_network_name } virtualNetworkNewOrExisting = { value = var.virtual_network_new_or_existing } virtualNetworkAddressPrefix = { value = var.virtual_network_address_prefix } virtualNetworkResourceGroup = { value = data.azurerm_resource_group.vnet.name } virtualMachineSize = { value = var.virtual_machine_size } subnetName = { value = var.subnet_name } subnetAddressPrefix = { value = var.subnet_address_prefix } adminUsername = { value = var.admin_username } }) lifecycle { ignore_changes = [parameter_values] } }   The benefit being that we can redeploy to another Availability Zone within a few mins in the event of a vMX or AZ failure... ... View more