This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I was going thru MS Learn for module - "Create a Windows virtual machine in Azure" and in the submodule "Configure Azure virtual machine network settings" it says:
Keep in mind that security groups are optional at both levels. If no security group is applied, then all traffic is allowed by Azure. If the VM has a public IP, this could be a serious risk, particularly if the OS doesn't provide some sort of firewall.
Question: If the default security group cannot be modified, overridden or deleted, how can we say security groups are optional at both the subnet and network interface level?
An Azure service that is used to provision Windows and Linux virtual machines.
Answer accepted by question author
Who said / Where is it stated that "default security group cannot be modified, overridden or deleted"?
Of cause, you can delete an NSG!
First, detach it and then delete it...
https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group
Thanks @Bjoern Peters for the quick response. My confusion came from my limited understanding and mixing security groups with security rules. Security rules cannot be modified or deleted but can be overridden by putting rules with a higher priority. Your are right, security groups can be disassociated before deletion. I am assuming this should apply to default security groups as well?
No problem...
Yes, you are right, the default roles in an NSG cannot be modified or deleted, and yes, you can add your own rules "behind" them.
So if you deploy for example a new VM and you check the box for creating an NSG, then this (and of cause to all new) NSGs will have the default rules included.
----------
If my answer was helpful to you, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".