Why are there Network Security Groups created automatically in azure and there is no bind Subnet?

Question

There are some pools in my batch accounts are created using this VNet and Subnet. Usually when we create VNet, we will bind an NSG in its Subnet, but the Subnet has no corresponding NSG attached.

1. So I don't understand why the irregular NSG in the picture was created and there was no Subnet.
2. Why the 'deployIfNotExists' Policy action failed.

Does anyone know about these?

Answer 1

Hello @v-shaota ,

Apologies for the delay in responding here and any inconvenience this issue may have caused.

1. When using Batch accounts, it by default adds NSGs at the network interfaces (NICs) level attached to compute nodes and this is to allow inbound communication from the Batch service to be able to schedule tasks on the compute nodes, and outbound communication to communicate with Azure Storage or other resources as needed by your workload.
   You may refer the following article for more details : https://learn.microsoft.com/en-us/azure/batch/nodes-and-pools#network-security-groups-batch-default
2. DeployIfNotExists is an Azure policy definition which executes a template deployment when a certain condition is met. This occurs if there are no related resources or if the resources defined by ExistenceCondition don't evaluate to true. However, what exactly failed in the deployment can be checked from more information on the activity log where you see it as failed.
   Please refer : https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#deployifnotexists

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.