Implement and Manage Virtual Networking · Topic 2 of 3
NSGs, Bastion and Private Access
AZ-104 secure access: NSG rules and priority, application security groups, effective rules, Azure Bastion SKUs, service endpoints compared with private endpoints.
- 5 min
- Includes a diagram
- NSG priority runs from 100 to 4096, lowest first. Default rules sit at 65000 and above.
- NSGs are stateful. Both the subnet and the interface NSG must allow traffic.
- An ASG groups interfaces by role so rules need no IP lists.
What it is
Once a network exists, you decide what may pass through it. Network security groups (NSGs) filter traffic by rule. Azure Bastion gives administrators a safe way into VMs. Service endpoints and private endpoints let your network reach Azure platform services without crossing the public internet.
How it works
Network security groups
An NSG is a list of security rules. Each rule has a priority, a source, a destination, a port, a protocol and an action of allow or deny.
- Priority is a number from 100 to 4096, and a lower number is processed first. Processing stops at the first match.
- NSGs are stateful. If an inbound request is allowed, the reply is allowed automatically.
- An NSG can be associated with a subnet, a network interface, or both.
- With both, inbound traffic is checked by the subnet NSG first and then the network interface NSG. Outbound traffic is checked in the opposite order. Traffic must be allowed at both.
Every NSG also has default rules that you cannot remove but can override with a lower priority number.
| Default inbound rule | Priority | Action |
|---|---|---|
| AllowVNetInBound | 65000 | Allow traffic from the virtual network |
| AllowAzureLoadBalancerInBound | 65001 | Allow the load balancer's health probes |
| DenyAllInBound | 65500 | Deny everything else |
Rules can use service tags, which name groups of addresses such as Internet, VirtualNetwork or Storage, so that you do not have to list IP addresses.
Application security groups
An application security group (ASG) groups network interfaces by role, such as WebServers. A rule can then use the ASG as its source or destination, instead of listing addresses. When a VM is added to the group, the rule applies automatically.
Effective security rules
The portal can show the effective security rules of a network interface. This merges the subnet NSG and the interface NSG into the rules that really apply, and it is the quickest way to see why traffic is blocked.
Azure Bastion
Azure Bastion lets you connect to a VM with RDP or SSH from the Azure portal over TLS, so the VM needs no public IP and no open management port.
- It is deployed into a subnet named AzureBastionSubnet, of /26 or larger.
- It reaches VMs in its own VNet and in peered VNets.
- SKUs are Developer, Basic, Standard and Premium. Standard adds custom ports, shareable links and native client support. Premium adds session recording.
Service endpoints and private endpoints
Both give access to Azure platform services such as Storage and SQL, in different ways.
| Service endpoint | Private endpoint | |
|---|---|---|
| What it does | Lets a subnet reach the service over the Azure backbone | Gives the service a private IP in your subnet |
| Service address | Still a public IP address | A private IP address |
| Scope | The whole service type, such as all of Storage | One specific resource |
| Reach from on premises | No | Yes, over VPN or ExpressRoute |
| Needs DNS changes | No | Yes, a private DNS zone |
For a storage account, the service endpoint is turned on in the subnet, and the storage firewall then allows that subnet. A private endpoint uses Azure Private Link and a private DNS zone, such as privatelink.blob.core.windows.net, so that the account name resolves to the private IP.
A worked NSG scenario
A web tier and a database tier share one subnet. Web servers must accept HTTPS from the internet, and the database must accept connections only from the web servers.
| Priority | Name | Source | Destination | Port | Action |
|---|---|---|---|---|---|
| 100 | AllowHttps | Internet | ASG Web | 443 | Allow |
| 110 | AllowSql | ASG Web | ASG Db | 1433 | Allow |
| 65500 | DenyAllInBound | Any | Any | Any | Deny |
The first two rules are yours. The last is the default rule, so database access from the internet is already denied. Using application security groups means that when a new web VM joins the group, the rules apply to it automatically.
How the exam asks about this
- "Connect to a VM without a public IP." Azure Bastion.
- "The Bastion subnet." AzureBastionSubnet, /26 or larger.
- "Custom ports or a shareable link." Bastion Standard or higher.
- "Reach a storage account privately from on premises." A private endpoint.
- Which NSG rule wins? The lowest priority number.
What to remember for the exam
- NSG priority runs from 100 to 4096, lowest first. Default rules sit at 65000 and above.
- NSGs are stateful. Both the subnet and the interface NSG must allow traffic.
- An ASG groups interfaces by role so rules need no IP lists.
- Effective security rules show the merged result for an interface.
- Bastion needs a subnet named AzureBastionSubnet of /26 or larger and removes the need for public IPs.
- A service endpoint keeps a public service address. A private endpoint uses a private IP and works from on premises.
"Reach the storage account from on premises over a private connection" points to a private endpoint, not a service endpoint.
Common mistakes
Ordering rules wrongly. A broad deny with a lower number than an allow blocks the allow.
Forgetting the second NSG. Traffic must pass both the subnet and the interface NSG.
Choosing a service endpoint for on premises access. It does not extend to on premises networks.
Forgetting DNS for a private endpoint. The name still resolves to the public address without the private zone.
Check yourself
What is the lowest priority number a custom NSG rule can use?
100, and a lower number is processed first.
What must the Bastion subnet be named?
AzureBastionSubnet, of /26 or larger.
Which gives a service a private IP in your subnet, a service endpoint or a private endpoint?
A private endpoint.
Topic 2 of 3 in Implement and Manage Virtual Networking
Test yourself on Implement and Manage Virtual Networking
The full Microsoft AZ-104 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.