A system architecture diagram showing three application security groups—AsgWeb, AsgApp, and AsgDb—each enclosing the VMs of that tier, with NSG rules allowing inbound 443 to web, 443 from web to app, and 1433 from app to database, while a default-deny posture blocks the database tier from initiating connections back to the web tier.
Network Security Groups (NSGs) act as a stateful firewall for Azure resources, filtering traffic at either the subnet or NIC (network interface) level. Each NSG contains a set of inbound and outbound security rules. Every rule must include a priority number between 100 and 4096; rules are evaluated from lowest to highest priority, and once a match occurs, no further rules are processed. Because of this evaluation order, you should place explicit Deny rules at a lower priority than broad Allow rules to block specific traffic while permitting the general flow. Service tags simplify rule creation by representing a group of Azure service IP address prefixes, such as VirtualNetwork, Internet, or AzureLoadBalancer, so you do not need to manage changing IP ranges yourself. Using a "deny by default, permit by exception" model ensures that only explicitly allowed traffic passes through the NSG, reducing the risk of unintended access.
Application Security Groups (ASGs) let you group virtual machines by their application role (for example, "web-tier," "app-tier," or "database-tier") without relying on fixed IP addresses. When you reference an ASG as the source or destination in an NSG rule, the rule automatically applies to all VMs that are members of that ASG, even as VMs are added or removed. This logical grouping eliminates the need to update NSG rules whenever the infrastructure scales. ASGs work best when you assign them based on dynamic attributes, such as the workload's function or environment tag, rather than static network location. To enforce least-privilege traffic controls, each application tier should only be able to communicate with the tiers it depends on; for example, the web tier can send traffic to the app tier, and the app tier can send traffic to the database tier, but the database tier should not initiate connections to the web tier.
NSG flow logs capture information about IP traffic flowing through an NSG, including source and destination IPs, ports, protocols, and whether the traffic was allowed or denied. These logs should be sent to Azure Monitor Log Analytics for long-term storage and analysis. Traffic Analytics processes flow log data to visualize traffic patterns, identify top talkers, and detect threat patterns such as port scans or unusual outbound traffic. For quick inventory and validation, use Azure Resource Graph to query NSG and ASG associations, rule priority settings, and rule configurations across your subscription. These monitoring tools help you identify misconfigurations, verify that segmentation policies are working, and troubleshoot connectivity issues before they become security incidents.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
Network Security Group rules are assigned priority numbers between 100 and 4096 and are evaluated in order from lowest to highest priority until a match occurs, at which point no further rules are processed. Because evaluation stops after a match, explicit Deny rules should be placed at a lower priority than broad Allow rules to block specific traffic while permitting general flow.
Application Security Groups (ASGs) allow virtual machines to be logically grouped by their application role rather than by static IP addresses. When an ASG is referenced as a source or destination in an NSG rule, the rule automatically applies to all member virtual machines as the infrastructure scales, eliminating the need to update rules when VMs are added or removed.
NSG flow logs capture source and destination IPs, ports, protocols, and allow or deny decisions, which can be sent to Azure Monitor Log Analytics for storage and analysis. Traffic Analytics processes this log data to visualize traffic patterns and detect threat patterns like port scans, while Azure Resource Graph queries NSG and ASG configurations and rule priorities across a subscription.
StudyCerts
StudyCerts