Create, change, or delete a network security group

1. In the search box at the top of the portal, enter Network security group. Select Network security groups in the search results.

2. Select + Create.

3. On the Create network security group page, under the Basics tab, enter or select the following values:

   Expand table

   Setting	Action
   Project details
   Subscription	Select your Azure subscription.
   Resource group	Select an existing resource group, or create a new one by selecting Create new. This example uses the myResourceGroup resource group.
   Instance details
   Network security group name	Enter a name for the NSG that you're creating.
   Region	Select the region that you want.

4. Select Review + create.

5. After you see the Validation passed message, select Create.

Use New-AzNetworkSecurityGroup to create an NSG named myNSG in the China North 3 region. The NSG named myNSG is created in the existing myResourceGroup resource group.

New-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup  -Location  chinanorth3

Use az network nsg create to create an NSG named myNSG in the existing myResourceGroup resource group.

az network nsg create --resource-group MyResourceGroup --name myNSG

In the search box at the top of the portal, enter Network security group. Select Network security groups in the search results to see the list of NSGs in your subscription.

Use Get-AzNetworkSecurityGroup to list all the NSGs in your subscription.

Get-AzNetworkSecurityGroup | format-table Name, Location, ResourceGroupName, ProvisioningState, ResourceGuid

Use az network nsg list to list all the NSGs in your subscription.

az network nsg list --out table

1. In the search box at the top of the portal, enter Network security group and select Network security groups in the search results.

2. Select the name of your NSG.

   • Under Settings, view the Inbound security rules, Outbound security rules, Network interfaces, and Subnets to which the NSG is associated.
   • Under Monitoring, enable or disable Diagnostic settings. For more information, see Resource logging for a network security group.
   • Under Help, view Effective security rules. For more information, see Diagnose a virtual machine (VM) network traffic filter problem.

   

To learn more about the common Azure settings that are listed, see the following articles:

• Activity log
• Access control identity and access management (IAM)
• Tags
• Locks
• Automation script

Use Get-AzNetworkSecurityGroup to view the details of an NSG.

Get-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup

To learn more about the common Azure settings that are listed, see the following articles:

• Activity log
• Access control (IAM)
• Tags
• Locks

Use az network nsg show to view the details of an NSG.

az network nsg show --resource-group myResourceGroup --name myNSG

To learn more about the common Azure settings that are listed, see the following articles:

• Activity log
• Access control (IAM)
• Tags
• Locks

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the name of your NSG, and then select Subnets.

   • To associate an NSG to the subnet, select + Associate. Then select your virtual network and the subnet to which you want to associate the NSG. Select OK.

     

   • To dissociate an NSG from the subnet, select the three dots next to the subnet from which you want to dissociate the NSG, and then select Dissociate. Select Yes.

     

Use Set-AzVirtualNetworkSubnetConfig to associate or dissociate an NSG to or from a subnet.

## Place the virtual network configuration into a variable. ##
$virtualNetwork = Get-AzVirtualNetwork -Name myVNet -ResourceGroupName myResourceGroup
## Place the network security group configuration into a variable. ##
$networkSecurityGroup = Get-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup
## Update the subnet configuration. ##
Set-AzVirtualNetworkSubnetConfig -Name mySubnet -VirtualNetwork $virtualNetwork -AddressPrefix 10.0.0.0/24 -NetworkSecurityGroup $networkSecurityGroup
## Update the virtual network. ##
Set-AzVirtualNetwork -VirtualNetwork $virtualNetwork

Use az network vnet subnet update to associate or dissociate an NSG to or from a subnet.

az network vnet subnet update --resource-group myResourceGroup --vnet-name myVNet --name mySubnet --network-security-group myNSG

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the NSG that you want to delete.

3. Select Delete, and then select Yes in the confirmation dialog box.

   

Use Remove-AzNetworkSecurityGroup to delete an NSG.

Remove-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup

Use az network nsg delete to delete an NSG.

az network nsg delete --resource-group myResourceGroup --name myNSG

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the name of the NSG to which you want to add a security rule.

3. Select Inbound security rules or Outbound security rules.

   Several existing rules are listed, including some that you might not have added. When you create an NSG, several default security rules are created in it. To learn more, see Default security rules. You can't delete default security rules, but you can override them with rules that have a higher priority.

4. Select + Add. Select or add values for the following settings, and then select Add.

   Expand table

   Setting	Value	Details
   Source	One of: Any IP Addresses My IP address Service Tag Application security group	If you select IP Addresses, you must also specify Source IP addresses/CIDR ranges. If you select Service Tag, you must also select a Source service tag. If you select Application security group, you must also select an existing application security group. If you select Application security group for both Source and Destination, the network interfaces within both application security groups must be in the same virtual network. Learn how to create an application security group.
   Source IP addresses/CIDR ranges	A comma-delimited list of IP addresses and Classless Interdomain Routing (CIDR) ranges	This setting appears if you set Source to IP Addresses. You must specify a single value or comma-separated list of multiple values. An example of multiple values is 10.0.0.0/16, 192.188.1.1. The number of values that you can specify is limited. For more information, see Azure limits. If the IP address that you specify is assigned to an Azure VM, specify its private IP address, not its public IP address. Azure processes security rules after it translates the public IP address to a private IP address for inbound security rules, but before it translates a private IP address to a public IP address for outbound rules. To learn more about IP addresses in Azure, see Public IP addresses and Private IP addresses.
   Source service tag	A service tag from the dropdown list	This setting appears if you set Source to Service Tag for a security rule. A service tag is a predefined identifier for a category of IP addresses. To learn more about available service tags, and what each tag represents, see Service tags.
   Source application security group	An existing application security group	This setting appears if you set Source to Application security group. Select an application security group that exists in the same region as the network interface. Learn how to create an application security group.
   Source port ranges	One of: A single port, such as 80 A range of ports, such as 1024-65535 A comma-separated list of single ports and/or port ranges, such as 80, 1024-65535 An asterisk (*) to allow traffic on any port	This setting specifies the ports on which the rule allows or denies traffic. The number of ports that you can specify is limited. For more information, see Azure limits.
   Destination	One of: Any IP Addresses Service Tag Application security group	If you select IP Addresses, you must also specify Destination IP addresses/CIDR ranges. If you select Service Tag, you must also select a Destination service tag. If you select Application security group, you must also select an existing application security group. If you select Application security group for both Source and Destination, the network interfaces within both application security groups must be in the same virtual network. Learn how to create an application security group.
   Destination IP addresses/CIDR ranges	A comma-delimited list of IP addresses and CIDR ranges	This setting appears if you change Destination to IP Addresses. You can specify single or multiple addresses or ranges like you can do with Source and Source IP addresses/CIDR ranges. The number that you can specify is limited. For more information, see Azure limits. If the IP address that you specify is assigned to an Azure VM, ensure that you specify its private IP, not its public IP address. Azure processes security rules after it translates the public IP address to a private IP address for inbound security rules, but before Azure translates a private IP address to a public IP address for outbound rules. To learn more about IP addresses in Azure, see Public IP addresses and Private IP addresses.
   Destination service tag	A service tag from the dropdown list	This setting appears if you set Destination to Service Tag for a security rule. A service tag is a predefined identifier for a category of IP addresses. To learn more about available service tags, and what each tag represents, see Service tags.
   Destination application security group	An existing application security group	This setting appears if you set Destination to Application security group. Select an application security group that exists in the same region as the network interface. Learn how to create an application security group.
   Service	A destination protocol from the dropdown list	This setting specifies the destination protocol and port range for the security rule. You can select a predefined service, like RDP, or select Custom and provide the port range in Destination port ranges.
   Destination port ranges	One of: A single port, such as 80 A range of ports, such as 1024-65535 A comma-separated list of single ports and/or port ranges, such as 80, 1024-65535 An asterisk (*) to allow traffic on any port	As with Source port ranges, you can specify single or multiple ports and ranges. The number that you can specify is limited. For more information, see Azure limits.
   Protocol	Any, TCP, UDP, or ICMP	You can restrict the rule to the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP). The default is for the rule to apply to all protocols (Any).
   Action	Allow or Deny	This setting specifies whether this rule allows or denies access for the supplied source and destination configuration.
   Priority	A value between 100 and 4,096 that's unique for all security rules within the NSG	Azure processes security rules in priority order. The lower the number, the higher the priority. We recommend that you leave a gap between priority numbers when you create rules, such as 100, 200, and 300. Leaving gaps makes it easier to add rules in the future so that you can give them higher or lower priority than existing rules.
   Name	A unique name for the rule within the NSG	The name can be up to 80 characters. It must begin with a letter or number, and it must end with a letter, number, or underscore. The name can contain only letters, numbers, underscores, periods, or hyphens.
   Description	A text description	You can optionally specify a text description for the security rule. The description can't be longer than 140 characters.

   

Use Add-AzNetworkSecurityRuleConfig to create an NSG rule.

## Place the network security group configuration into a variable. ##
$networkSecurityGroup = Get-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup
## Create the security rule. ##
Add-AzNetworkSecurityRuleConfig -Name RDP-rule -NetworkSecurityGroup $networkSecurityGroup `
-Description "Allow RDP" -Access Allow -Protocol Tcp -Direction Inbound -Priority 300 `
-SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389
## Updates the network security group. ##
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $networkSecurityGroup

Use az network nsg rule create to create an NSG rule.

az network nsg rule create --resource-group myResourceGroup --nsg-name myNSG --name RDP-rule --priority 300 \
    --destination-address-prefixes '*' --destination-port-ranges 3389 --protocol Tcp --description "Allow RDP"

To duplicate existing security rules, you can export the JSON of the existing NSG, extract the securityRules, and include it in your ARM template.

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the name of the NSG for which you want to duplicate the rules.

3. In the NSG's Overview page, expand the Essentials section and select the JSON View link on the far right.

4. In the Resource JSON half-pane, find "properties". Within "properties", find "securityRules". Copy the full object of the security rule(s) you want to duplicate.

5. In the search box at the top of the portal, enter Deploy a custom template and select it in the search results.

6. In the Custom deployment page, select Build your own template in the editor.

7. In the Edit template page, specify the existing NSG where you want to duplicate the rules to through its name and location. Within the "properties" -> "securityRules" of the NSG, paste the copied security rule object(s).

8. Select Save. Select the desired subscription, resource group, and region, then select Review + create.

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the name of the NSG for which you want to view the rules.

3. Select Inbound security rules or Outbound security rules.

   The list contains any rules that you created and the default security rules of your NSG.

   

Use Get-AzNetworkSecurityRuleConfig to view the security rules of an NSG.

## Place the network security group configuration into a variable. ##
$networkSecurityGroup = Get-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup
## List security rules of the network security group in a table. ##
Get-AzNetworkSecurityRuleConfig -NetworkSecurityGroup $networkSecurityGroup | format-table Name, Protocol, Access, Priority, Direction, SourcePortRange, DestinationPortRange, SourceAddressPrefix, DestinationAddressPrefix

Use az network nsg rule list to view the security rules of an NSG.

az network nsg rule list --resource-group myResourceGroup --nsg-name myNSG

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the name of the NSG for which you want to view the rules.

3. Select Inbound security rules or Outbound security rules.

4. Select the rule for which you want to view details. For an explanation of all settings, see Security rule settings.

   Note

   This procedure applies only to a custom security rule. It doesn't work if you choose a default security rule.

   

Use Get-AzNetworkSecurityRuleConfig to view the details of a security rule.

## Place the network security group configuration into a variable. ##
$networkSecurityGroup = Get-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup
## View details of the security rule. ##
Get-AzNetworkSecurityRuleConfig -Name RDP-rule -NetworkSecurityGroup $networkSecurityGroup

Use az network nsg rule show to view the details of a security rule.

az network nsg rule show --resource-group myResourceGroup --nsg-name myNSG --name RDP-rule

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the name of the NSG for which you want to view the rules.

3. Select Inbound security rules or Outbound security rules.

4. Select the rule that you want to change.

5. Change the settings as needed, and then select Save. For an explanation of all settings, see Security rule settings.

   

   Note

   This procedure applies only to a custom security rule. You aren't allowed to change a default security rule.

Use Set-AzNetworkSecurityRuleConfig to update an NSG rule.

## Place the network security group configuration into a variable. ##
$networkSecurityGroup = Get-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup
## Make changes to the security rule. ##
Set-AzNetworkSecurityRuleConfig -Name RDP-rule -NetworkSecurityGroup $networkSecurityGroup `
-Description "Allow RDP" -Access Allow -Protocol Tcp -Direction Inbound -Priority 200 `
-SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389
## Updates the network security group. ##
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $networkSecurityGroup

Use az network nsg rule update to update an NSG rule.

az network nsg rule update --resource-group myResourceGroup --nsg-name myNSG --name RDP-rule --priority 200

1. In the search box at the top of the portal, enter Network security group. Then select Network security groups in the search results.

2. Select the name of the NSG for which you want to view the rules.

3. Select Inbound security rules or Outbound security rules.

4. Select the rules that you want to delete.

5. Select Delete, and then select Yes.

   

   Note

   This procedure applies only to a custom security rule. You aren't allowed to delete a default security rule.

Use Remove-AzNetworkSecurityRuleConfig to delete a security rule from an NSG.

## Place the network security group configuration into a variable. ##
$networkSecurityGroup = Get-AzNetworkSecurityGroup -Name myNSG -ResourceGroupName myResourceGroup
## Remove the security rule. ##
Remove-AzNetworkSecurityRuleConfig -Name RDP-rule -NetworkSecurityGroup $networkSecurityGroup
## Updates the network security group. ##
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $networkSecurityGroup

Use az network nsg rule delete to delete a security rule from an NSG.

az network nsg rule delete --resource-group myResourceGroup --nsg-name myNSG --name RDP-rule

1. In the search box at the top of the portal, enter Application security group. Then select Application security groups in the search results.

2. Select + Create.

3. On the Create an application security group page, under the Basics tab, enter or select the following values:

   Expand table

   Setting	Action
   Project details
   Subscription	Select your Azure subscription.
   Resource group	Select an existing resource group, or create a new one by selecting Create new. This example uses the myResourceGroup resource group.
   Instance details
   Name	Enter a name for the application security group that you're creating.
   Region	Select the region in which you want to create the application security group.

   

4. Select Review + create.

5. After you see the Validation passed message, select Create.

Use New-AzApplicationSecurityGroup to create an application security group.

New-AzApplicationSecurityGroup -ResourceGroupName myResourceGroup -Name myASG -Location chinanorth3

Use az network asg create to create an application security group.

az network asg create --resource-group myResourceGroup --name myASG --location chinanorth3

In the search box at the top of the portal, enter Application security group. Then select Application security groups in the search results. A list of your application security groups appears in the Azure portal.

Use Get-AzApplicationSecurityGroup to list all the application security groups in your Azure subscription.

Get-AzApplicationSecurityGroup | format-table Name, ResourceGroupName, Location

Use az network asg list to list all the application security groups in a resource group.

az network asg list --resource-group myResourceGroup --out table

1. In the search box at the top of the portal, enter Application security group. Then select Application security groups in the search results.

2. Select the application security group for which you want to view the details.

Use Get-AzApplicationSecurityGroup to view the details of an application security group.

Get-AzApplicationSecurityGroup -Name myASG

Use az network asg show to view the details of an application security group.

az network asg show --resource-group myResourceGroup --name myASG

1. In the search box at the top of the portal, enter Application security group. Then select Application security groups in the search results.

2. Select the application security group that you want to change:

   • Select move next to Resource group or Subscription to change the resource group or subscription, respectively.

   • Select edit next to Tags to add or remove tags. To learn more, see Use tags to organize your Azure resources and management hierarchy.

     

     Note

     You can't change the location of an application security group.

   • Select Access control (IAM) to assign or remove permissions to the application security group.

You can't change an application security group by using PowerShell.

Use az network asg update to update the tags for an application security group.

az network asg update --resource-group myResourceGroup --name myASG --tags Dept=Finance

1. In the search box at the top of the portal, enter Application security group. Then select Application security groups in the search results.

2. Select the application security group that you want to delete.

3. Select Delete, and then select Yes to delete the application security group.

   

Use Remove-AzApplicationSecurityGroup to delete an application security group.

Remove-AzApplicationSecurityGroup -ResourceGroupName myResourceGroup -Name myASG

Use az network asg delete to delete an application security group.

az network asg delete --resource-group myResourceGroup --name myASG