Microsoft has just announced the release of a groundbreaking feature in their Azure cloud platform that enables port mirroring of virtual machines. For years, achieving full network visibility in cloud environments has been a significant challenge for security teams. In traditional on-premises networks, port mirroring (also known as SPAN) has been used to replicate traffic and feed it into monitoring and security tools. But in the cloud, things aren’t so straightforward.
However, with the release of Azure virtual network TAP, a new, innovative capability opens up exciting possibilities for network monitoring and security solutions, including our own Network Detection and Response (NDR) solution.
In this article, we'll explore what Azure virtual network TAP is, how it works, and why it's a game-changer for organizations like yours that rely on deep packet inspection for security and compliance purposes.
What is Virtual Network TAP?
Virtual network TAP allows you to capture and forward network traffic from one or more virtual machines (VMs) in Azure to another VM or a designated destination. This feature utilizes the VXLAN tunneling protocol, making it possible to efficiently transmit network traffic across multiple virtual networks while maintaining low latency and high scalability.
How Does it Work?
You can create a "tap" on an existing Azure VM, which will forward all incoming and outgoing network traffic to a designated destination. This destination could be another VM in the same or different Azure subscription.
Why Has Port Mirroring in the Cloud Been So Challenging?
Public cloud platforms like Azure abstract away the underlying infrastructure, making it difficult for security professionals to tap into the same level of network telemetry they rely on in physical environments. As a result, many organizations have had to settle for less effective alternatives like agent-based monitoring or flow logs. While useful, these methods fall short of delivering the deep packet inspection and real-time analysis required to detect modern threats.
This lack of visibility is especially problematic when it comes to monitoring east-west traffic – the lateral movement of data between virtual machines within a cloud environment. Threat actors often exploit this blind spot to move undetected once inside a network.
With Azure virtual network TAP, security teams can play the game on their own terms. It gives organizations a native, cloud-friendly way to mirror VM traffic in Azure without the need for intrusive agents or expensive third-party tooling.
By enabling efficient and scalable traffic forwarding using VXLAN tunnelling, virtual network TAP empowers security teams with the packet-level visibility they’ve been missing in the cloud, and it does so without compromising performance or scalability.
How Virtual Network TAP Powers Next-Gen Threat Detection
Given that eSentire specializes in Managed Detection and Response solutions, we're thrilled about the possibilities offered by virtual network TAP. Azure users can now unlock powerful new use cases that were previously difficult or impossible to implement in cloud-native environments.
Here’s how this feature helps organizations elevate their security posture:
- Advanced Threat Detection: Mirrored network traffic can be ingested into an NDR or Intrusion Detection System (IDS) tool for deep inspection. This allows you to spot command-and-control activity, data exfiltration, lateral movement, and other advanced detections by observing subtle indicators of compromise that traditional logging can miss.
- Forensics & Incident Response: When a security incident occurs, access to full packet captures is essential for root cause analysis. Virtual network TAP enables continuous traffic capture, so your team can replay network sessions, reconstruct events, and respond with confidence.
- Zero Trust Validation: Many organizations are adopting zero trust architectures but validating that segmentation policies are working as intended can be tricky. With virtual network TAP you can monitor east-west traffic in real time and ensure policy enforcement across your Azure workloads.
- Compliance Monitoring: Regulations like PCI-DSS, HIPAA, and GDPR increasingly require granular visibility into network traffic for auditing and compliance purposes. Virtual network TAP helps meet those requirements by providing the packet-level data needed to prove control effectiveness and maintain compliance posture.
By leveraging virtual network TAP, our customers can now access the deep packet inspection capabilities they need while running their workloads on Azure. As a result, we'll be able to develop new solutions that unlock even greater value for our mutual customers, including improved security posture and compliance with regulatory requirements.
How eSentire Supercharges Azure Security
Microsoft's virtual network TAP feature is a significant addition to the Azure platform, offering organizations like yours unprecedented flexibility and power in their network security initiatives.
At eSentire, we’re constantly evolving our MDR and NDR capabilities to meet the needs of hybrid and cloud-first organizations. We can now directly ingest mirrored traffic from Azure-hosted workloads, delivering the same level of deep packet inspection and behavioral analytics that our customers have come to rely on in on-premises environments. This opens the door to enhanced visibility into east-west traffic, real-time threat detection, and faster containment of sophisticated attacks — all within your Azure footprint.
We’re actively building out native integrations that leverage Azure Virtual Network TAP to accelerate threat triage and response times for Azure workloads. This enhancement supports a wide range of use cases, from forensic packet analysis to compliance monitoring and Zero Trust enforcement.
If you're looking to extend the reach of your existing eSentire MDR investment or want to enhance your Azure security posture with full packet visibility, our team is ready to help you get started.
