1.

Sign in
Go to [Link] and make sure you’re in the right Directory and
Subscription (top-right of the portal).
2. Create the Resource Group

 Left menu: Resource groups → Create

 Subscription: (your target)
 Resource group: MyRG
 Region: your choice (e.g., Australia East)
 Click Review + create → Create.

3. Start a Virtual Network

 Top search bar: type Virtual networks → Create

 Subscription: (same as above)
 Resource group: select MyRG
 Name: MyVNet
 Region: same as the resource group region (recommended).

4. Address Space (/24)

 Go to the IP addresses tab.

 IPv4 address space: enter [Link]/24.
(You can remove any default range Azure pre-fills and add this one.)

5. Add the Subnet (/26)

 Still on IP addresses → Subnets section → + Add subnet

o Subnet name: MySubnet
o Subnet address range: [Link]/26
o Leave other options (NSG, route table, service endpoints) as default for now.
 Click Add.

6. (Optional) DNS settings

 Security or DNS servers tab (varies slightly by portal version): keep Azure-
provided for now unless you need custom DNS.

7. Review & Create

 Click Review + create → ensure validation passes → Create.

8. Verify

 When deployment finishes, open the MyVNet resource.

 Check Address space shows [Link]/24.
 Open Subnets blade and confirm MySubnet is present with [Link]/26.
2) Create a Network Security Group (NSG)
1. Left nav: All services → Networking → Network security groups → + Create.
2. Subscription: (same as before)
3. Resource group: MyRG
4. Name: MyNSG
5. Region: same as your VNet (recommended)
6. Review + create → Create.

3) Inspect the NSG you just made

1. Open MyNSG → Overview and Settings.

(a) Default inbound/outbound rules you’ll see

 Inbound (defaults):
o AllowVNetInBound (priority 65000)
o AllowAzureLoadBalancerInBound (priority 65001)
o DenyAllInBound (priority 65500)
 Outbound (defaults):
o AllowVNetOutBound (priority 65000)
o AllowInternetOutBound (priority 65001)
o DenyAllOutBound (priority 65500)

(b) Network interfaces associated: 0 (you haven’t attached it yet).

(c) Subnets associated: 0 (you haven’t attached it yet).

Why? NSGs are standalone until you associate them with either a subnet or a NIC.

4) Associate the NSG to your subnet

1. In MyNSG → Settings → Subnets → + Associate.
2. Virtual network: MyVNet
3. Subnet: MySubnet
4. OK.

5) Check on the VNet

 Go Virtual networks → open MyVNet.
 On Subnets, you’ll see MySubnet with Network security group = MyNSG.
(The VNet Overview doesn’t list NSGs directly; the Subnets blade shows the
association.)
6) Check on the subnet
 In MyVNet → Subnets → click MySubnet.
 You should see Network security group: MyNSG.

7) Create an Application Security Group (ASG)

1. Left nav: All services → Networking → Application security groups → + Create.
2. Subscription: (same)
3. Resource group: MyRG
4. Name: MyASG
5. Region: same as VNet/NSG
6. Review + create → Create → Go to resource.

8) Create a Linux VM
1. Top search: Virtual machines → + Create → Azure virtual machine.
2. Subscription: (same)
3. Resource group: MyRG
4. Virtual machine name: e.g., MyVM
5. Region: same as VNet
6. Image: Ubuntu LTS (or your choice)
7. Size: change to B1s
8. Authentication type: Password (enter username/password)
9. Inbound port rules: Allow selected ports → SSH (22)
10. Networking tab:
o Virtual network: MyVNet
o Subnet: MySubnet
o Confirm it shows your selections.
11. Review + create → Create.

What does Azure say about the VM’s NSG?

When you choose Allow selected ports: SSH (22), the wizard creates (or selects) a NIC-
level NSG for the VM with an inbound rule to allow TCP/22. If the subnet already has an
NSG (your MyNSG), both the NIC NSG and the subnet NSG will apply; traffic must be
allowed by both.

9) VM → Networking: what do you see?

1. Open Virtual machines → MyVM → Settings → Networking.
 o Network security group: you’ll typically see a NIC-level NSG named like
MyVM-nsg (created by the wizard).
o Inbound port rules: you’ll see 1 custom rule allowing SSH (22), plus the 3
default inbound rules (the UI often groups defaults separately).
Why? Because you picked “Allow SSH” during creation, so Azure added one
explicit allow rule on the NIC NSG; defaults are always present.

(Tip: click Effective security rules on this blade to see the combined effect of the NIC NSG
and your subnet NSG (MyNSG).)

10) VM → Topology: what is the NSG connected to?

 Topology shows the NIC connected to its NIC-level NSG (e.g., MyVM-nsg).
 You’ll also see the subnet (within MyVNet) which has MyNSG attached. Both are in
the path.

11) Add the VM to your ASG

1. On MyVM → Networking → Application security groups tab.
2. Click Configure the application security groups.
3. Select MyASG → Save.

12) Add a subnet-level inbound rule targeting the ASG

1. Go back to MyNSG (the subnet NSG) → Inbound security rules → + Add.
2. Source: Any
3. Source port ranges: *
o (If you set it to 22 you’ll see a caution about filtering on source ports—Azure
uses ephemeral source ports; filtering on source ports is not recommended.
Switch it back to *.)
4. Destination: Application security group → pick MyASG
5. Service: Custom
6. Destination port ranges: 22
7. Protocol: TCP
8. Priority: 100
9. Name: SSH_traffic
10. Add.

13) Back to the VM: how many inbound rules now?

  On MyVM → Networking, the NIC NSG still shows its original SSH allow (plus
defaults).
 If you click Effective security rules, you’ll now see two allows for TCP/22—one
from the NIC NSG and one from the subnet NSG (SSH_traffic to MyASG).
Effective result: SSH is allowed (it must pass both NSGs; duplicates are fine).

14) Click the SSH_traffic rule (in MyNSG): what warning

appears?
 Azure warns that allowing SSH from “Any” source can expose your VM to the
internet and is not recommended. It suggests restricting the source (e.g., to your
public IP or a trusted range) or using Just-In-Time access.

15) Clean up: delete everything (order + common errors)

Recommended order to avoid dependency errors:

1. Delete the VM (MyVM)

o This will remove the NIC and Public IP. The NIC-level NSG (e.g., MyVM-
nsg) is often left behind; if it remains, delete it next.
2. Delete the NIC-level NSG (if it still exists).
3. Remove the ASG from the NIC (not needed if NIC got deleted with the VM).
4. On MyNSG:
o Delete the SSH_traffic rule that references MyASG (if you plan to delete
ASG first; otherwise delete NSG first).
5. Disassociate MyNSG from the subnet:
o MyNSG → Subnets → select MySubnet → Disassociate.
6. Delete MyNSG.
7. Delete MyASG (will fail if still referenced by any NSG rule).
8. Delete the subnet MySubnet (will fail if any NICs are still attached).
9. Delete the VNet MyVNet.
10. Delete the resource group MyRG (this also cleans up any stragglers inside).

Likely errors & how to handle them

 “Cannot delete NSG because it is in use by subnet.”

→ Disassociate the NSG from the subnet first.
 “Cannot delete ASG because it is referenced by NSG rule.”
→ Remove the NSG rule(s) that reference the ASG or delete the NSG first.
 “Cannot delete subnet because it is in use by resources.”
→ Ensure all NICs/VMs/Private Endpoints are deleted or detached from the subnet.
 “Cannot delete VNet because it has subnets.”
→ Delete all subnets first.
  RG delete stuck:
→ Open the RG Deployments tab to see failures; fix dependencies, then retry delete.

(Optional) Azure CLI equivalents

# Create NSG
az network nsg create -g MyRG -n MyNSG -l australiaeast

# Associate NSG to subnet

az network vnet subnet update -g MyRG --vnet-name MyVNet -n MySubnet --
network-security-group MyNSG

# Create ASG
az network asg create -g MyRG -n MyASG -l australiaeast

# Add VM to ASG (after VM exists; attach ASG to NIC)

NIC_NAME=$(az vm show -g MyRG -n MyVM --query
'[Link][0].id' -o tsv | awk -F/ '{print $NF}')
az network nic update -g MyRG -n "$NIC_NAME" --application-security-groups
MyASG

# Add subnet-level NSG rule to ASG (SSH allow)

az network nsg rule create -g MyRG --nsg-name MyNSG -n SSH_traffic \
--priority 100 --access Allow --direction Inbound --protocol Tcp \
--source-address-prefixes '*' --source-port-ranges '*' \
--destination-asgs MyASG --destination-port-ranges 22

# Cleanup helpers
az vm delete -g MyRG -n MyVM --yes
az network nsg rule delete -g MyRG --nsg-name MyNSG -n SSH_traffic
az network vnet subnet update -g MyRG --vnet-name MyVNet -n MySubnet --
remove networkSecurityGroup
az network nsg delete -g MyRG -n MyNSG
az network asg delete -g MyRG -n MyASG
az network vnet subnet delete -g MyRG --vnet-name MyVNet -n MySubnet
az network vnet delete -g MyRG -n MyVNet
az group delete -n MyRG --yes --no-wait

If you run into a specific error message during clean-up, paste it here and I’ll decode it and
give you the