As organizations continue migrating applications to the cloud, security and traffic management become critical concerns. Simply deploying a virtual machine or hosting an application is no longer enough. Modern cloud environments require multiple layers of protection, intelligent traffic routing, and mechanisms to prevent unauthorized access.

Microsoft Azure provides several services to address these challenges, and two of the most important are Network Security Groups (NSGs) and Azure Application Gateway.

Although both services deal with network traffic, they serve very different purposes. Understanding how they work individually — and how they complement each other — is essential for designing secure, scalable, and production-ready Azure environments.

In this article, we’ll explore what NSGs and Application Gateways are, how they function, and the best practices for using them effectively.

Why Security and Traffic Management Matter in Azure

Consider a typical web application hosted in Azure:

• Users access the application through the internet.
• Requests are routed to web servers or application services.
• The application communicates with databases and other backend services.
• Administrators require secure access for maintenance and monitoring.

Without proper controls:

• Unauthorized users may gain access to sensitive resources.
• Applications become vulnerable to malicious attacks.
• Internal services may be unnecessarily exposed to the public internet.
• Traffic may not be routed efficiently, leading to performance issues.

Azure addresses these challenges through a layered security model. NSGs act as the first line of defense at the network level, while Application Gateway provides intelligent traffic management and web application protection.

Understanding Network Security Groups (NSGs)

A Network Security Group (NSG) is Azure’s built-in network filtering service. Think of it as a virtual firewall that controls inbound and outbound traffic for Azure resources.

NSGs allow administrators to define rules that determine which traffic is allowed and which traffic should be blocked.

These rules can be applied to:

• Individual Virtual Machine network interfaces (NICs)
• Entire subnets
• Multiple resources within a virtual network

The primary goal of an NSG is to ensure that only approved traffic reaches your resources.

How NSGs Work

Every NSG contains a collection of security rules.

Each rule defines:

• Source IP address
• Destination IP address
• Source port
• Destination port
• Protocol (TCP, UDP, or Any)
• Direction (Inbound or Outbound)
• Action (Allow or Deny)
• Priority

Azure evaluates rules based on priority.

For example:

PriorityRuleAction100Allow HTTPSAllow200Allow SSH from Admin IPAllow300Deny All Other TrafficDeny

When traffic arrives:

1. Azure checks the lowest priority number first.
2. If a match is found, the corresponding action is applied.
3. Rule evaluation stops immediately.

This ensures predictable and efficient traffic filtering.

A Real-World NSG Example

Imagine you host an e-commerce website on Azure.

Your requirements might include:

• Allow customers to access the website over HTTPS.
• Allow administrators to connect via SSH.
• Block all other inbound traffic.

An NSG can enforce these requirements by permitting traffic on port 443 for everyone while restricting SSH access to specific administrative IP addresses.

As a result:

• Customers can browse the website normally.
• Administrators retain secure access.
• Attackers cannot probe unnecessary ports.

This simple configuration significantly reduces the application’s attack surface.

Default NSG Rules

Azure automatically creates default rules within every NSG.

Some examples include:

Inbound Rules

• Allow traffic within the Virtual Network
• Allow Azure Load Balancer traffic
• Deny all other inbound traffic

Outbound Rules

• Allow traffic within the Virtual Network
• Allow internet access
• Deny all other outbound traffic

These defaults provide a secure starting point while allowing essential communication.

Understanding Azure Application Gateway

While NSGs focus on network-level traffic filtering, Azure Application Gateway operates at the application layer.

Application Gateway is a Layer 7 load balancer that understands HTTP and HTTPS traffic.

Unlike traditional load balancers that only examine IP addresses and ports, Application Gateway can inspect:

• URLs
• Host headers
• Cookies
• HTTP requests
• HTTPS requests

This enables much smarter routing decisions.

Why Traditional Load Balancing Isn’t Enough

Suppose your organization hosts three applications:

www.company.com
api.company.com
admin.company.com

Using traditional load balancing often requires separate infrastructure or complex configurations.

Application Gateway simplifies this process by acting as a single entry point.

It can inspect incoming requests and automatically route traffic to the appropriate backend service.

api.company.com
       ↓
API Servers

admin.company.com
       ↓
Admin Portalwww.company.com
       ↓
Website Servers

/company/products/*
          ↓
Product Service

/company/orders/*
          ↓
Order Service

Client
   ↓ HTTPS
Application Gateway
   ↓ HTTP or HTTPS
Backend Servers

/api/*
      ↓
API Cluster

/images/*
         ↓
Media Servers/admin/*
        ↓
Admin Portal

Internet
    ↓
Application Gateway + WAF
    ↓
Application Subnet
    ↓
Network Security Group
    ↓
Virtual Machines / AKS / App Services

Allow Any → Any