Network Security Group

Network Security GroupLast Updated:  6th March 2025

Azure Network Security Groups: A Comprehensive Guide

Technical Overview

Imagine you’re managing a sprawling virtual network in Azure, with dozens of virtual machines (VMs), databases, and application services. The challenge? Ensuring that only the right traffic flows between these resources while blocking malicious or unauthorised access. This is where Azure Network Security Groups (NSGs) come into play. NSGs act as a virtual firewall at the network interface or subnet level, allowing you to control inbound and outbound traffic based on rules you define.

Architecture

At its core, an NSG is a collection of security rules that define how traffic is filtered. Each rule specifies:

  • Priority: A number that determines the order in which rules are applied. Lower numbers have higher priority.
  • Source and Destination: The IP address, CIDR block, or service tag that identifies the traffic origin and target.
  • Protocol: TCP, UDP, or Any.
  • Port Range: The port or range of ports the rule applies to.
  • Action: Allow or Deny.

NSGs can be associated with either a subnet or a network interface card (NIC). When applied to a subnet, the rules affect all resources within that subnet. When applied to a NIC, the rules only affect the specific VM or resource attached to that NIC. This dual-layer approach provides granular control over traffic.

Scalability

NSGs are designed to scale with your Azure environment. You can define up to 1,000 rules per NSG, and each Azure subscription can support thousands of NSGs. Additionally, NSGs integrate seamlessly with Azure’s service tags and application security groups, allowing you to dynamically manage traffic without constantly updating IP addresses.

Data Processing

NSGs process traffic in a specific order:

  • First, Azure applies system default rules, which allow essential Azure infrastructure traffic.
  • Next, custom rules are evaluated based on their priority.
  • Finally, if no rule matches, the traffic is denied by default.

This layered approach ensures that critical Azure services remain accessible while giving you full control over other traffic.

Integration Patterns

NSGs integrate with several Azure services to enhance security and simplify management:

  • Service Tags: These predefined tags represent Azure services (e.g., Storage, SQL) and eliminate the need to manage IP addresses manually.
  • Application Security Groups (ASGs): ASGs allow you to group VMs and apply NSG rules to the group, rather than individual IPs or NICs.
  • Azure Firewall: While NSGs control traffic at the network level, Azure Firewall provides centralised, stateful traffic inspection for your entire environment.

Advanced Use Cases

NSGs are not just about blocking or allowing traffic; they enable sophisticated network architectures:

  • Microsegmentation: Use NSGs to isolate workloads within the same virtual network, ensuring that only authorised traffic flows between them.
  • Hybrid Connectivity: Combine NSGs with VPN gateways or ExpressRoute to secure traffic between on-premises environments and Azure.
  • Zero Trust Networking: Implement a zero-trust model by defining strict NSG rules that only allow traffic explicitly required for business operations.

Business Relevance

In today’s threat landscape, network security is non-negotiable. NSGs provide a powerful yet flexible way to enforce security policies, making them invaluable for organisations of all sizes. Here’s why they matter:

  • Cost-Effective Security: NSGs are included with Azure at no additional cost, offering robust protection without straining budgets.
  • Regulatory Compliance: By controlling traffic flow, NSGs help organisations meet compliance requirements like PCI DSS, HIPAA, and GDPR.
  • Operational Efficiency: With features like service tags and ASGs, NSGs reduce the administrative overhead of managing network security.

For businesses migrating to Azure, NSGs provide a familiar and straightforward way to replicate on-premises firewall rules, accelerating cloud adoption.

Best Practices

To maximise the effectiveness of NSGs, consider these best practices:

  • Start with Least Privilege: Define rules that allow only the traffic necessary for your applications to function.
  • Use Service Tags and ASGs: Simplify rule management by leveraging these dynamic features.
  • Monitor and Audit: Use Azure Monitor and Network Watcher to track NSG rule effectiveness and identify misconfigurations.
  • Document Rules: Maintain clear documentation of your NSG rules to streamline troubleshooting and audits.
  • Combine with Other Tools: Use NSGs alongside Azure Firewall and Microsoft Defender for Cloud for comprehensive security.

Relevant Industries

NSGs are versatile and applicable across various industries:

  • Financial Services: Protect sensitive customer data by isolating workloads and enforcing strict traffic controls.
  • Healthcare: Ensure compliance with HIPAA by securing patient data and controlling access to critical systems.
  • Retail: Safeguard e-commerce platforms and payment systems from unauthorised access.
  • Manufacturing: Secure IoT devices and production systems within Azure virtual networks.
  • Government: Meet stringent security and compliance requirements by implementing granular traffic controls.

Related Azure Services