Direct answer
An Azure network security group is one layer of network filtering. Review rule priority, direction and attachment together with routing and the destination service's own controls.
Map attachments and rules
Record the network interface or subnet, owners, inbound and outbound rules, priorities, protocols, ports and sources. Identify default rules and other security groups or controls that apply to the path; a rule name alone does not establish effective exposure.
Reference: Microsoft: Network security groups.
Compare with intended flows
For a database intended only for an application subnet, compare the rule set with the documented source and destination matrix. Include public IPs, routing and host firewall in the assessment; a permissive rule does not prove internet reachability by itself.
- Review both IPv4 and IPv6 where used.
- Identify rule ownership and expiration.
- Preserve the existing support and recovery paths.
Test representative paths
Using authorized source hosts and a known-good listener, test one expected allowed and one prohibited path. Record source, destination, port, time and actual result. Use provider diagnostics and logs where available to help distinguish a rule denial from an unavailable service.
Apply and verify
Pilot rule changes, review their impact on every attached workload and use an approved rollback plan. Repeat the allowed and denied tests and confirm the application workflow still functions after deployment.
Assessment limits
Effective connectivity can involve routing, other NSGs, host firewalls and application authentication. One connectivity test cannot prove all locations and failover paths are restricted.
Frequently asked questions
Does a broad NSG rule prove a service is public?
No. Addressing, routes and other controls determine the complete network path.
Why inspect rule priority?
The effective result depends on how the provider evaluates applicable rules, not just whether a specific allow or deny entry exists.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.