# Network Security Group

> Network security groups are free on every Azure subscription, with no hourly meter and no per-rule charge, yet their allow/deny rules decide which resources are exposed and which dependencies exist. ZopNight inventories every NSG via Resource Graph with rule and association context, feeding exposure review and the dependency topology.

Source: https://zop.dev/integrations/azure/nsg
Updated: 2026-08-19

---

Network security groups filter traffic to subnets and network interfaces with allow/deny rules. They are free but central to understanding exposure and dependencies.

## No charge on NSGs, real weight on exposure

An NSG costs nothing to create, hold, or evaluate; Azure applies its rules without any meter running. That makes NSGs unusual in this directory: the reason to inventory them is not what they spend but what they reveal. An allow rule from the internet to a management port tells you a VM is reachable in a way its cost data never would. A deny-all posture on a subnet full of expensive machines suggests an internal batch environment, exactly the kind of workload that tolerates aggressive scheduling.

## Rules and associations ZopNight captures

Discovered via Azure Resource Graph with rule and association context, supporting topology and hygiene review. The association side matters as much as the rules: an NSG binds at subnet scope, NIC scope, or both, and knowing which resources sit behind which rule set is part of the dependency picture ZopNight builds before any action is recommended. NSGs are discovery only. There is no lifecycle operation to schedule, and nothing about an NSG changes when the resources behind it stop or start.

## Why a cost platform reads firewall rules

Two hygiene patterns come up repeatedly. First, unassociated NSGs: groups created for a project, detached during a redesign, and left floating with rules that no longer protect anything. They cost nothing but accumulate as noise that makes security review slower. Second, rules referencing deleted resources: source or destination ranges that pointed at machines long gone. Both are signals of a half-cleaned environment, and half-cleaned environments are where billable orphans (disks, IPs, gateways) tend to cluster too.

## Reviewing NSGs in the portal

Azure portal → Network security groups lists every NSG with its resource group and region. Selecting one shows inbound and outbound rules plus its subnet and network-interface associations, one group at a time. ZopNight's advantage is simply seeing all of them at once, joined to the resources they guard.