Skip to main content
Network Security Groups (NSGs) control inbound and outbound network traffic to resources inside an Azure Virtual Network (VNet). An NSG contains ordered security rules that explicitly allow or deny traffic based on source, destination, protocol, and port.

​
Where you can associate an NSG

  • Subnet — applies rules to all resources within the subnet.
  • Network interface (NIC) — applies rules to a single virtual machine or NIC.
An NSG can be associated with multiple subnets and NICs so the same policy can be reused across resources. When an NSG is applied at both the subnet and NIC level, traffic must be allowed by both NSGs to traverse to the VM.

​
How NSG rules are evaluated

Rules are evaluated in order of their numeric priority (lower number = higher precedence). Azure also enforces built-in system rules that provide default behavior; these cannot be deleted but can be effectively overridden by higher-precedence custom rules.
Resource associationEffect
SubnetControls traffic for all resources in that subnet (applies to traffic entering/exiting the subnet).
NICControls traffic for the specific VM’s network interface (applies after subnet rules).

​
Common rule properties

PropertyDescriptionExample
priorityNumeric order for evaluation. Lower numbers take precedence.100, 200
nameUnique identifier for the rule within the NSG.Allow-SSH-From-AdminNet
protocolTCP, UDP, or * (Any).TCP
port(s)Single port or range.22, 3389, 80-443
sourceCIDR IP range, service tag, or Application Security Group (ASG).203.0.113.0/24, Internet, VirtualNetwork
destinationCIDR, service tag, or ASG.10.0.1.0/24, ApplicationGateway
actionAllow or DenyAllow
A slide titled "NSG Rules" showing tables of inbound and outbound Azure network security group rules with columns for Priority, Name, Port, Protocol, Source, Destination and Action (Allow/Deny). Example entries include an RDP_Inbound rule for port 3389 and default Allow/Deny rules for VirtualNetwork, AzureLoadBalancer and Internet.

​
Default system rules

Azure NSGs include built-in rules that provide baseline connectivity. These default rules cannot be removed and have fixed priorities:
  • AllowVNet (service tag: VirtualNetwork) — permits traffic inside the VNet.
  • AllowAzureLoadBalancer (service tag: AzureLoadBalancer) — permits load balancer health probes.
  • AllowInternet / DenyAll (depending on direction) — controls internet access or denies remaining traffic.
Custom rules should be created with numeric priorities in the typical range 100–4096. Place more specific rules at higher precedence (lower numeric values) so they override broader defaults.
Default NSG rules provide the baseline and cannot be deleted. To override a default, create a custom rule with a lower numeric priority (higher precedence). Prefer service tags and Application Security Groups for flexible, maintainable rules instead of hard-coded IP addresses.

​
Service tags and Application Security Groups (ASGs)

Use service tags (e.g., VirtualNetwork, Internet, AzureLoadBalancer) and ASGs to simplify rule management:
  • Service tags represent a group of IP address prefixes for Azure services and are maintained by Microsoft.
  • ASGs group NICs or VMs by application role, allowing you to create rules that refer to the group instead of individual IPs.
These features reduce rule churn and improve readability of NSG rule sets.

​
Common use cases

  • Open a management port from a known IP range (e.g., RDP TCP 3389 or SSH TCP 22).
  • Restrict web tier access to only a load balancer or an application gateway.
  • Allow only specific application-to-application traffic using ASGs for micro-segmentation.

​
Example: create an NSG and add a rule

Azure CLI 
# Create an NSG
az network nsg create \
  --resource-group MyResourceGroup \
  --name MyNSG

# Add an inbound rule to allow SSH from a specific IP range
az network nsg rule create \
  --resource-group MyResourceGroup \
  --nsg-name MyNSG \
  --name Allow-SSH-Admin \
  --priority 100 \
  --source-address-prefixes 203.0.113.0/24 \
  --destination-port-ranges 22 \
  --access Allow \
  --protocol Tcp \
  --direction Inbound
PowerShell 
# Create NSG
New-AzNetworkSecurityGroup -ResourceGroupName "MyResourceGroup" -Name "MyNSG"

# Add a rule
$rule = New-AzNetworkSecurityRuleConfig -Name "Allow-SSH-Admin" `
  -Description "Allow SSH from admin network" -Access Allow -Protocol Tcp `
  -Direction Inbound -Priority 100 -SourceAddressPrefix "203.0.113.0/24" `
  -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 22

$nsg = Get-AzNetworkSecurityGroup -ResourceGroupName "MyResourceGroup" -Name "MyNSG"
$nsg.SecurityRules.Add($rule)
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $nsg
Be careful when adding restrictive rules (especially for management ports). Misconfigured NSG rules can lock you out of virtual machines. Always test rules with a low-risk host or allow a temporary breakpoint rule for your own IP before applying globally.

​
Best practices

  • Use least privilege: only open required ports and limit source ranges.
  • Prefer service tags and ASGs over static IPs.
  • Use clear, consistent naming conventions that include intent and scope (e.g., Allow-HTTP-From-ALB).
  • Keep rule sets minimal and remove obsolete rules.
  • Monitor and log traffic (Network Watcher, NSG flow logs) to validate rules and detect anomalies.
With these concepts and examples, you can design NSG rule sets that meet both security and operational needs while remaining manageable and easy to audit.

Watch Video