Azure Network WorkbenchOpen Workbench

How it works

How Azure Network Workbench analyses network architecture

Azure access happens where your credentials already are. The workbench reads a normalized result and never performs Azure authentication.

The architecture flow: an Azure subscription read by a collector on the operator workstation, normalized evidence, and analysis in the browser Workbench, with an optional connected branch that relays the artifacts to the coordinating workspace.

Local collection, normalized evidence, and browser-side analysis, with Azure credentials staying on the workstation.

Main architecture flow

Detailed process stages

Customer Azure

Subscriptions, resource groups, virtual networks, and the resources inside them, read with a normal operator identity.

Local collector

aznw runs on the operator workstation with locally available credentials and produces normalized artifacts. A local run keeps them on the workstation, and a connected Pro agent hands the artifacts it produces to the workspace coordinating the session - never an Azure credential.

Normalized analysis

A network snapshot and a network graph describe what exists and how it is related, independent of any rendering technology.

Azure Network Workbench

The browser reads the graph, derives topology, and analyses the architecture. A graph you select stays in the browser session; a connected analysis is stored durably in the signed-in workspace, so it can be reopened or deleted.

What that means

Azure access is local
Credentials are used on the machine that performs collection and are not uploaded.
Evidence is normalized
The product derives architecture evidence from the artifact, so the same graph produces the same result every time.
The browser analyses, never authenticates
The workbench has no Azure identity. It reads a graph and reports what that graph supports.
Agent connectivity stays local
A Pro agent collects on your machine. SaaS-side Azure credentials are not part of the design: a connected session relays the artifacts it produces to the control plane coordinating it, and never an Azure credential.

Artifacts

ArtifactPurposeState
NetworkSnapshotRaw collected Azure network state for a scope.Produced by local collection
NetworkGraphNormalized topology, containment, and relationships.Read by the Workbench
FindingsDeterministic architecture findings derived from the evidence an analysis carries.Available from Pro evidence
Routing, security, reachability and trace evidencePer-subnet decisions, inbound posture, pair verdicts, and trace results.Available from Pro evidence
Explore DemoAnalyse a local graph