Associating NSG to VM instead of Subnet

Question

Dear All,

We have a Azure virtual Desktop infra. We have created a NSG rule and associated with the individual VM NICs.

The subnet is shared with other Azure services, so we are unable to attach at the subnet level.

Now, part of monthly patching we may have to delete the VMs and recreate using the updated Master image. The entire process will be done using Azure Devops.

Query: I need to automate the process of associating the NSG with individual VM nics after the VM creation. Could someone help on this?

Answer 1

You can use PowerShell or ARM templates (JSON) to achieve this.

Yes, I agree with Eric. I suspect the easiest option for you given that you already have your NSG resource created is to get the resource ID of this and pass it in to your ARM template as a parameter and then associate this to the new network interface resource in the JSON as in the below example (lines 28-30).

       {
            "name": "[parameters('networkInterfaceName')]",
            "type": "Microsoft.Network/networkInterfaces",
            "apiVersion": "2021-03-01",
            "location": "[parameters('location')]",
            "dependsOn": [
                "[concat('Microsoft.Network/publicIpAddresses/', parameters('publicIpAddressName'))]"
            ],
            "properties": {
                "ipConfigurations": [
                    {
                        "name": "ipconfig1",
                        "properties": {
                            "subnet": {
                                "id": "[variables('subnetRef')]"
                            },
                            "privateIPAllocationMethod": "Static",
                            "publicIpAddress": {
                                "id": "[resourceId(resourceGroup().name, 'Microsoft.Network/publicIpAddresses', parameters('publicIpAddressName'))]",
                                "properties": {
                                    "deleteOption": "[parameters('pipDeleteOption')]"
                                }
                            }
                        }
                    }
                ],
                "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
                "networkSecurityGroup": {
                    "id": "[parameters('nsgId')]"
                }
            }

Answer 2

Hi @Julie M

We automate all of our Azure Virtual Desktop deployments for customers using Azure Resource Manager (ARM) templates or Bicep. You can associate an existing Network Security Group by Id with the NIC of the VM, or you can create the Network Security Group and configure the security rules inline too.

Here's the ARM/Bicep reference documentation for the Microsoft.Network/networkinterfaces resource type and you specifically want to look for the networkSecurityGroup property. https://learn.microsoft.com/en-us/azure/templates/microsoft.network/networkinterfaces?tabs=bicep#networkinterfacepropertiesformat

Answer 3

Thanks a lot @Alan Kinane and anonymous user for your help.