# Azure NSG Flow Logs Past End-of-Life

> Flags NSG flow logs ahead of Azure's 30 September 2027 retirement so they can be migrated to virtual network flow logs.

Source: https://zop.dev/integrations/azure/recommendations/azure-nsg-flow-logs-past-end-of-life

---

## Azure is retiring NSG flow logs on a fixed date

[Network Watcher's NSG flow logs overview](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview)
sets the timeline: NSG flow logs retire on 30 September 2027, and because the feature is
retiring, new NSG flow logs can no longer be created. After the retirement date Azure stops
supporting traffic analytics on NSG flow logs and deletes the existing NSG flow log resources
in your subscription.

The successor is the virtual network flow log, which can target a virtual network, a subnet or
a network interface. Microsoft also recommends it for VMs with heavy network traffic, where NSG
flow logging can fail.

## Listing NSG flow logs per region

Flow logs belong to the Network Watcher of each region, so run this for every region you use:

```bash
az network watcher flow-log list --location eastus \
  --query "[?contains(targetResourceId, 'networkSecurityGroups')].{name:name, target:targetResourceId, enabled:enabled}" \
  -o table
```

Rows whose target is a `networkSecurityGroups` resource are the ones to migrate.

## The only condition: an NSG target

ZopNight reads the target of each flow log and fires when it is a network security group.
Unlike the cost-driven flow log checks, it does not require the log to be enabled: Azure deletes
the resource on the retirement date whether or not it is logging, so the migration is due in
either case. There are no metrics, prices or windows involved.

## Flow logs that are not flagged

Virtual network flow logs are never flagged; they are the destination of the migration. If
ZopNight cannot tell what a flow log targets, it raises nothing, since guessing "NSG" would flag
the very virtual network flow logs you migrated to.

## A deadline, and a volume effect ZopNight does not price

The finding carries no saving. Migration can reduce log volume, because one virtual network flow
log can replace NSG flow logs set at both subnet and network-interface level on the same
traffic, but how much depends on your layout, so ZopNight does not estimate it. Traffic analytics
on virtual network flow logs is charged per GB processed, and log storage is billed separately.
Where two logs already record the same packets, see
<a href="https://zop.dev/integrations/azure/recommendations/azure-duplicate-flow-logging">Azure Duplicate Flow Logging</a>.

## Migrating before the deadline

1. In Network Watcher, open **Migrate flow logs**, pick subscriptions and regions, and download
   the migration script and config file, as described in
   [Migrate to virtual network flow logs](https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-migrate).
2. Or create the replacement yourself, for example
   `az network watcher flow-log create --location eastus --resource-group my-rg --name vnet-flowlog --vnet my-vnet --storage-account mystorage`.
3. Confirm flow records arrive, and repoint traffic analytics at the new log.
4. Disable or delete the NSG flow log. Microsoft recommends disabling NSG flow logs on the same
   workloads before enabling virtual network flow logs, to avoid duplicate logging and cost.

**Warning**
Do not change network topology in the affected regions while the migration script runs.