Azure network security: VNets, NSGs, Azure Firewall, private endpoints and Bastion
In short: Azure network security combines network security groups for basic filtering, Azure Firewall for central inspection in a hub, private endpoints to keep PaaS traffic off the internet, and Azure Bastion for admin access without public IPs. User-defined routes tie them together.
Starting point: the VNet
An Azure Virtual Network (VNet) is your private network in a region (the general ideas are in cloud networking basics). By default, resources in a VNet can talk to each other and reach the internet outbound. Security work is about narrowing those defaults and adding inspection where it matters.
Network security groups
A network security group (NSG) is a list of stateful allow and deny rules, checked in priority order (lowest number first). You can attach an NSG to a subnet, a network interface, or both. Each NSG includes default rules that allow VNet-to-VNet traffic and load balancer probes, and deny other inbound internet traffic.
- Use service tags such as
Internet,VirtualNetworkorStorageinstead of long IP lists. - Use application security groups (ASGs) to group VMs by role, for example "allow 443 from asg-web to asg-app".
- Turn on VNet flow logs (the successor to NSG flow logs) and analyse them in Log Analytics.
az network nsg rule create --resource-group rg-app --nsg-name nsg-app --name allow-web-to-app --priority 200 --direction Inbound --access Allow --protocol Tcp --source-asgs asg-web --destination-asgs asg-app --destination-port-ranges 8443Azure Firewall and routing
Azure Firewall is a managed, stateful firewall service. It supports network rules, application rules based on fully qualified domain names (FQDNs), threat intelligence filtering and, in the Premium tier, TLS inspection and intrusion detection and prevention. It normally sits in a hub VNet. Spoke VNets peer with the hub, and user-defined routes (UDRs) send their traffic to the firewall's private IP.
| Control | Layer | Best for |
|---|---|---|
| NSG | 3-4 | Basic allow/deny on subnets and NICs |
| Azure Firewall | 3-7 | Central egress control, FQDN filtering, logging |
| Application Gateway or Front Door WAF | 7 | Protecting web apps from attacks like SQL injection |
| DDoS Protection | 3-4 | Absorbing volumetric attacks on public IPs |
Private endpoints and Bastion
Platform services such as Storage, SQL Database and Key Vault have public endpoints by default. A private endpoint gives the service a private IP in your VNet using Azure Private Link. Pair it with a private DNS zone so the normal name resolves to the private IP, then disable public network access on the service.
Azure Bastion provides RDP and SSH to VMs through the Azure portal or native client over TLS, so VMs need no public IP and port 3389 or 22 never faces the internet. Combine it with just-in-time VM access in Defender for Cloud for extra control.
Tip: build and test NSG rules on your own subscription in the Azure VNet and NSG lab.
Practice
What is the difference between an NSG and Azure Firewall?
After adding a private endpoint for a storage account, apps still use the public IP. What is likely missing?
How does Azure Bastion improve security?
Key takeaways
- NSGs are stateful, priority-ordered rules on subnets and NICs.
- Azure Firewall in a hub, with UDRs, centralises inspection and logging.
- Private endpoints plus private DNS keep PaaS traffic private.
- Bastion removes the need for public IPs on VMs.
- Add WAF and DDoS protection for public-facing apps.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.