You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Gauge your current knowledge
Gauge your current knowledge
Network Security Groups (NSGs) act as a virtual firewall that filters traffic for Azure resources using a set of security rules. Each rule uses a five-tuple system—source, source port, destination, destination port, and protocol (TCP or UDP)—to decide whether to allow or deny traffic. Because NSGs are stateful, when a rule permits traffic in one direction, the return traffic is automatically allowed without needing a separate rule.
You can associate an NSG at the subnet level, the network interface (NIC) level, or both, creating layers of security. For inbound traffic, Azure evaluates the subnet NSG first and then the NIC NSG; both must allow the traffic for it to reach the resource. For outbound traffic, the order is reversed: the NIC NSG is processed before the subnet NSG. If a resource has no NSG associated with its subnet or NIC, all traffic is blocked by default when the resource has a public IP.
Every rule has a priority number ranging from 100 to 4096, where lower numbers have higher priority and are processed first. Once traffic matches a rule, Azure stops evaluating any further rules. This makes priority critical for resolving conflicts. Azure includes several default rules to ensure basic connectivity:
To manage complex environments, you can use Application Security Groups (ASGs) and Service Tags to reduce the number of rules. ASGs let you group virtual machines by function (for example, “WebServers”) so you apply rules to logical groups instead of individual IP addresses. Service Tags represent groups of IP addresses for specific Azure services, such as Storage.EastUS, and update dynamically as the service’s IP ranges change. These tools help you maintain security without manual updates.
For centralized management, Security Admin Rules from Azure Virtual Network Manager provide a higher level of control that sits above standard NSG rules. These rules are evaluated before any NSG rules and can be set to “Always Allow” or “Deny” to enforce company-wide policies. This creates a defense-in-depth strategy where central administrators set the baseline security, while individual teams manage application-specific needs through their own NSGs. Understanding this hierarchy is essential for determining the effective security rules applied to any resource.
Application Security Groups (ASGs) allow you to logically group virtual machines by application workload, enabling application-centric network segmentation. Instead of creating individual NSG rules for each VM or managing lists of IP addresses, you define ASGs that represent roles or tiers—such as web servers, business logic, or databases. This approach simplifies network security policy management and aligns it closely with your application architecture, making it easier to enforce granular access control.
You create an ASG using the Azure Portal, PowerShell, or CLI, specifying the resource group and region. After creation, you associate the network interfaces of your VMs with the appropriate ASG. A single network interface can belong to multiple ASGs, allowing flexible grouping based on workload requirements. All network interfaces in an ASG must reside in the same virtual network, ensuring consistent policy enforcement within that boundary.
NSGs act as the enforcement mechanism by filtering inbound and outbound traffic using rules that reference ASGs as the source or destination. For example, you can allow HTTP traffic from the Internet to all VMs in the “asg-web” group, or restrict database access so only VMs in the “asg-logic” group can connect to those in “asg-db”. NSG rules are processed in order of priority, and when multiple rules apply, the one with the highest priority (lowest number) takes precedence. This enables application-aware security policies that are both scalable and easy to maintain.
Key benefits of using ASGs include centralized management of security rules, simplified rule creation by referencing ASGs rather than explicit IP addresses, and enhanced segmentation that isolates workloads and minimizes the attack surface. When designing your network, plan ASGs according to your application’s tiers and access requirements. Regularly review and update your ASGs and NSG rules to align with changes in your application and network architecture.
Network Security Groups (NSGs) are essential for controlling inbound and outbound traffic to Azure resources. They act as a basic, stateful, packet-filtering firewall, allowing you to manage access based on IP address and TCP or UDP protocols. NSGs help ensure that only legitimate traffic is allowed to and from your virtual machines and services.
NSGs include several features that simplify management and reduce configuration errors:
StudyCerts
StudyCertsStorage.EastUS applies to all Azure storage in the East US region.To configure NSG rules, you must understand priority and default rules. NSG rules are evaluated based on their priority, with lower numbers having higher precedence. Each rule specifies a priority, action (allow or deny), direction (inbound or outbound), protocol (TCP, UDP, or any), and source and destination (IP addresses or service tags). You apply NSGs to subnets or network interfaces. When applied to a subnet, the rules affect all resources within that subnet. When applied to a network interface, the rules only affect the specific resource connected to that interface.
By understanding and implementing NSG rules, you can effectively manage and secure traffic flow within your Azure virtual networks, ensuring robust network security and compliance.