4.2AZ-104Intermediate
Est: ~15 mins•Verified: 2026-08

Network Security Groups (NSG) & Application Security Groups (ASG)

Design stateful packet filtering rules, priority evaluations, default security rules, and Application Security Group (ASG) workload isolation in Azure.

Tags:#NSG#ASG#Firewall#Security#Networking#AZ-104
01

Overview

Network Security Groups (NSG) contain a list of stateful Access Control List (ACL) rules that allow or deny network traffic to Azure subnets or individual virtual machine Network Interfaces (NICs).

  1. Rule Evaluation: Evaluated by Priority (100 to 4096) in numerical order. Lowest number has highest priority. Once a match is found, processing stops.
  2. Default Inbound Rules:
  • 65000: AllowVNetInBound (Allows all inter-VNet traffic)
  • 65001: AllowAzureLoadBalancerInBound
  • 65500: DenyAllInBound (Blocks all external internet inbound by default)
  1. Application Security Groups (ASGs): Group virtual machines logically by application function (e.g., ASG-WebServers, ASG-DatabaseServers) to author zero-IP firewall rules.

---

02

When to Use: Subnet vs NIC NSG Association

Association LevelRecommended Best PracticeOperational Outcome
Subnet AssociationPrimary Security BoundaryApplies macro security policies to all VMs placed within the subnet uniformly.
NIC AssociationSpecific Micro-SegmentationOverrides or adds granular rules for a single specific multi-homed VM.
Application Security GroupTier-based isolationRules read Allow ASG-Web to ASG-DB on port 1433 without hardcoding IP addresses.

---

03

Prerequisites

  • Target Virtual Network with subnets created.
  • Network Contributor permissions.

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
├── Network security groups
│   └── Create > Link to Subnets or Network Interfaces
└── Application security groups
    └── Create > Assign to VM Network Interfaces

---

05

Step-by-Step Implementation

Step 1: Create Application Security Groups (ASG)

  1. In Azure Portal, search Application security groups > Click Create.
  2. Create two ASGs: asg-web-tier and asg-db-tier in rg-networking.
  3. Open target Web VM > Networking > Application security groups > Add asg-web-tier.
  4. Open target Database VM > Networking > Add asg-db-tier.

Step 2: Create NSG Rule using ASGs

  1. Open your Network Security Group (nsg-workload-subnet).
  2. Select Inbound security rules > Click + Add.
  3. Configure rule allowing Web to talk to Database:
  • Source: Application security group > asg-web-tier.
  • Source port ranges: *.
  • Destination: Application security group > asg-db-tier.
  • Service: MS SQL (Port 1433).
  • Protocol: TCP.
  • Action: Allow.
  • Priority: 200.
  • Name: Allow-WebTier-To-DBTier-SQL.
  1. Add a rule with Priority 300 to Block all other inbound traffic to asg-db-tier.

---

06

PowerShell Automation

Author Inbound NSG Rule via Azure PowerShell:

PowerShell
# Retrieve existing NSG
$NSG = Get-AzNetworkSecurityGroup -ResourceGroupName "rg-network" -Name "nsg-app-subnet"

# Add inbound HTTPS rule
$NSG | Add-AzNetworkSecurityRuleConfig -Name "Allow-HTTPS-Internet" `
    -Description "Allow public inbound web traffic" `
    -Access "Allow" `
    -Protocol "Tcp" `
    -Direction "Inbound" `
    -Priority 100 `
    -SourceAddressPrefix "Internet" `
    -SourcePortRange "*" `
    -DestinationAddressPrefix "*" `
    -DestinationPortRange "443"

# Commit changes to Azure
$NSG | Set-AzNetworkSecurityGroup

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/4 (0%)
Effective security rules on VM NIC show the custom rules with priority 100/200.
Database port 1433 accepts connections from Web ASG members.
Database port 1433 rejects connections originating outside the Web ASG.
Subnet association shows NSG actively bound.
08

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Inbound traffic dropped despite Allow ruleSubnet NSG allowed traffic, but NIC NSG blocked it (traffic evaluates both).Use Effective security rules on the VM Network Interface to identify the blocking rule.
Cannot add ASG to NSG ruleThe ASG and the NSG reside in different Azure regions.ASGs and NSGs must reside in the same region and virtual network.

---

09

AZ-104 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Both Subnet and NIC NSGs: Inbound traffic is evaluated by Subnet NSG first, then NIC NSG second. Outbound traffic is evaluated by NIC NSG first, then Subnet NSG second.
  2. Default Rules: Default rules (Priority 65000+) cannot be deleted, but they CAN be overridden by creating rules with priority between 100 and 4096.
  3. Stateful Filtering: Azure NSGs are stateful. If inbound traffic is allowed, outbound response traffic is automatically allowed regardless of outbound rules.

---

10

Official Documentation

PREVIOUS TOPIC4.1 Virtual Networks: Subnets & VNet PeeringNEXT TOPIC4.3 Azure Load Balancer, Application Gateway & Private DNS Zones