| JNTech

Azure NSG vs NIC – Outbound Hierarchy and Override Rules (AZ-104)

In Azure, outbound traffic can be controlled by Network Security Groups (NSGs) associated with a subnet or a network interface (NIC).

Feature	Subnet-level NSG	NIC-level NSG
Applied to	Subnet	Individual VM's NIC
Scope	All resources covered by the subnet NSG	Specific NIC
Outbound evaluation	Evaluates outbound traffic leaving the subnet	Evaluates outbound traffic leaving the NIC
Inbound evaluation	Evaluates inbound traffic entering the subnet	Evaluates inbound traffic entering the NIC
Override behavior	Rules do not override NIC-level NSG rules	Rules do not override subnet-level NSG rules
When both NSGs exist	Outbound traffic must be allowed by both NSGs	Outbound traffic must be allowed by both NSGs
Deny behavior	A deny at this level blocks traffic even if the other NSG allows it	A deny at this level blocks traffic even if the other NSG allows it
Priority	Lower number has higher priority within this NSG	Lower number has higher priority within this NSG
Default outbound rules	Includes default rules such as `AllowVNetOutbound`, `AllowInternetOutbound`, and `DenyAllOutbound`	Includes the same default outbound rules
Typical use	Apply common security rules to an entire subnet	Apply additional security rules to an individual VM

Outbound traffic evaluation

VM
 |
NIC-level NSG
 |
Subnet-level NSG
 |
Destination

Important AZ-104 rules:

Both NSGs must allow the traffic when NSGs are associated with both the NIC and subnet.
Allow at NIC + Deny at subnet = Deny.
Deny at NIC + Allow at subnet = Deny.
NSG rules are evaluated by priority within each NSG; NIC-level rules do not override subnet-level rules.

If no NSG is associated at one level, only the NSG at the other level applies.

Azure NSG Priority Rules: NIC vs Subnet (AZ-104)

Key rule: The lowest numerical priority wins within each NSG. When both NSGs are attached, traffic must be allowed by both. Outbound traffic evaluates the NIC NSG first, then the subnet NSG; inbound traffic evaluates the subnet NSG first, then the NIC NSG.

Microsoft Learn

1. Priority within each NSG

Rule Priority	Action	Result within that NSG
100 — Allow	Allow	Allowed if no earlier matching rule exists
200 — Deny	Deny	Denied if this is the first matching rule
300 — Allow	Allow	Not evaluated if priority 100 already matched

Example: If priority 100 allows HTTPS and priority 200 denies HTTPS, HTTPS is allowed because priority 100 matches first.

2. All NIC and Subnet combinations

Assume each NSG has a matching rule for the same traffic.

NIC NSG priority	NIC action	Subnet NSG priority	Subnet action	Final result
100	Allow	100	Allow	Allow
100	Allow	200	Allow	Allow
200	Allow	100	Allow	Allow
100	Allow	200	Deny	Deny
200	Deny	100	Allow	Deny
100	Deny	200	Deny	Deny
200	Deny	100	Deny	Deny
300	Allow	100	Deny	Deny

Important: Priority numbers are compared only within the same NSG. NIC priority 100 does not automatically take precedence over subnet priority 200. Each NSG independently selects its first matching rule.

3. Default NSG rule priorities

Priority	Default rule	Direction	Action
65000	AllowVNetInBound	Inbound	Allow VNet traffic
65001	AllowAzureLoadBalancerInBound	Inbound	Allow Azure Load Balancer traffic
65500	DenyAllInBound	Inbound	Deny all other inbound traffic
65000	AllowVNetOutBound	Outbound	Allow VNet traffic
65001	AllowInternetOutBound	Outbound	Allow Internet traffic
65500	DenyAllOutBound	Outbound	Deny all other outbound traffic

Source: Microsoft Learn — Network security groups overview.

Exam shortcut: First find the matching rule with the lowest numerical priority in each NSG; then check whether both NSGs allow the traffic. If either denies it, the traffic is blocked.

Azure NSG vs NIC – Outbound Hierarchy and Override Rules (AZ-104)

Azure NSG vs NIC – Outbound Hierarchy and Override Rules (AZ-104)

Outbound traffic evaluation

Azure NSG Priority Rules: NIC vs Subnet (AZ-104)

1. Priority within each NSG

2. All NIC and Subnet combinations

3. Default NSG rule priorities

Keep Learning - More From This Category