A network security group (NSG) is a collection of access control lists (ACLs) that allow or deny network traffic to subnets, network interface cards (NICs), or both. NSGs can be associated with subnets or individual NICs belonging to a subnet. When an NSG is attached to a subnet, the ACL rules apply to all VMs on that subnet. Furthermore, traffic to a NIC can be managed by directly connecting an NSG to it.
