Network Security Groups (NSG)

What is an NSG?

An NSG is a list of security rules that allow or deny inbound and outbound network traffic. Rules are evaluated in priority order. The first matching rule wins — processing stops at that rule.

Rule Properties

Every NSG rule has these properties:

Service Tags

Service Tags are named groups of IP address prefixes managed by Microsoft. They simplify rules by representing groups of Azure services without requiring you to know specific IP ranges:

Default Rules

Every NSG has three default rules that cannot be deleted — only overridden by higher-priority rules:

Default Inbound Rules

Default Outbound Rules

Applying NSGs

NSGs can be applied at two levels:

Subnet Level

Applies to all traffic entering/leaving the subnet. All resources in the subnet are subject to the rules. Best for applying consistent policies to a tier (e.g., all web servers).

NIC Level

Applies to traffic for a specific VM's network interface. Allows per-VM rules in addition to subnet-level rules.

Traffic Evaluation

For inbound traffic to a VM:

1. Traffic hits the subnet NSG first
2. Rules evaluated in priority order (lowest number first)
3. First matching rule is applied — processing stops
4. If allowed, traffic proceeds to the NIC NSG
5. NIC NSG rules evaluated in same way
6. If allowed by both, traffic reaches the VM

Application Security Groups (ASG)

ASGs let you group VMs logically and use those groups in NSG rules instead of IP addresses. This makes rules readable and maintainable — especially as your infrastructure grows.

# Create ASGs
az network asg create --name WebServers --resource-group myRG --location centralindia
az network asg create --name AppServers --resource-group myRG --location centralindia
az network asg create --name DbServers  --resource-group myRG --location centralindia

# Associate VM NIC with ASG
az network nic ip-config update \
  --resource-group myRG \
  --nic-name vm-web-nic \
  --name ipconfig1 \
  --application-security-groups WebServers

# Create NSG rule using ASGs
az network nsg rule create \
  --resource-group myRG \
  --nsg-name myNSG \
  --name Allow-Web-to-App \
  --priority 200 \
  --source-asgs WebServers \
  --destination-asgs AppServers \
  --destination-port-ranges 8080 \
  --protocol TCP \
  --access Allow

Effective Security Rules

When troubleshooting connectivity, check the Effective Security Rules for a NIC — it shows the combined result of both the subnet NSG and NIC NSG, making it easy to see exactly what is allowed and denied.

In the Azure Portal: VM → Networking → Network Interface → Effective security rules

Creating and Managing NSGs

# Create NSG
az network nsg create \
  --resource-group myRG \
  --name web-nsg \
  --location centralindia

# Allow HTTP inbound
az network nsg rule create \
  --resource-group myRG \
  --nsg-name web-nsg \
  --name Allow-HTTP \
  --priority 100 \
  --source-address-prefixes Internet \
  --destination-port-ranges 80 \
  --protocol TCP \
  --access Allow

# Allow HTTPS inbound
az network nsg rule create \
  --resource-group myRG \
  --nsg-name web-nsg \
  --name Allow-HTTPS \
  --priority 110 \
  --source-address-prefixes Internet \
  --destination-port-ranges 443 \
  --protocol TCP \
  --access Allow

# Attach NSG to subnet
az network vnet subnet update \
  --resource-group myRG \
  --vnet-name myVNet \
  --name web-subnet \
  --network-security-group web-nsg

Common NSG Rule Examples