Microsoft.Network networkSecurityGroups

Bicep resource definition

The networkSecurityGroups resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Usage Examples

Bicep Samples

A basic example of deploying network security group that contains a list of network security rules. Network security groups enable inbound or outbound traffic to be enabled or denied.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource networkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2022-07-01' = {
  name: resourceName
  location: location
  properties: {
    securityRules: []
  }
}

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Azure Quickstart Samples

The following Azure Quickstart templates contain Bicep samples for deploying this resource type.

Resource format

To create a Microsoft.Network/networkSecurityGroups resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Network/networkSecurityGroups@2025-07-01' = {
  location: 'string'
  name: 'string'
  properties: {
    flushConnection: bool
    securityRules: [
      {
        id: 'string'
        name: 'string'
        properties: {
          access: 'string'
          description: 'string'
          destinationAddressPrefix: 'string'
          destinationAddressPrefixes: [
            'string'
          ]
          destinationApplicationSecurityGroups: [
            {
              id: 'string'
              location: 'string'
              properties: {}
              tags: {
                {customized property}: 'string'
              }
            }
          ]
          destinationPortRange: 'string'
          destinationPortRanges: [
            'string'
          ]
          direction: 'string'
          priority: int
          protocol: 'string'
          sourceAddressPrefix: 'string'
          sourceAddressPrefixes: [
            'string'
          ]
          sourceApplicationSecurityGroups: [
            {
              id: 'string'
              location: 'string'
              properties: {}
              tags: {
                {customized property}: 'string'
              }
            }
          ]
          sourcePortRange: 'string'
          sourcePortRanges: [
            'string'
          ]
        }
      }
    ]
  }
  tags: {
    {customized property}: 'string'
  }
}

Property Values

Microsoft.Network/networkSecurityGroups

CommonApplicationSecurityGroup

CommonApplicationSecurityGroupPropertiesFormat

CommonNetworkSecurityGroupPropertiesFormat

CommonResourceTags

CommonResourceTags

CommonSecurityRule

CommonSecurityRulePropertiesFormat

ARM template resource definition

The networkSecurityGroups resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands For a list of changed properties in each API version, see change log.

Usage Examples

Azure Quickstart Templates

The following Azure Quickstart templates deploy this resource type.

Template	Description
1 VM in vNet - Multiple data disks	This template creates a single VM running Windows Server 2016 with multiple data disks attached.
101-1vm-2nics-2subnets-1vnet	Creates a new VM with two NICs which connect to two different subnets within the same VNet.
2 VMs in a Load Balancer and configure NAT rules on the LB	This template allows you to create 2 Virtual Machines in an Availability Set and configure NAT rules through the load balancer. This template also deploys a Storage Account, Virtual Network, Public IP address and Network Interfaces. In this template, we use the resource loops capability to create the network interfaces and virtual machines
201-vnet-2subnets-service-endpoints-storage-integration	Creates 2 new VMs with a NIC each, in two different subnets within the same VNet. Sets service endpoint on one of the subnets and secures storage account to that subnet.
Add an NSG with Redis security rules to an existing subnet	This template allows you to add an NSG with preconfigured Azure Redis Cache security rules to an existing subnet within a VNET. Deploy into the resource group of the existing VNET.
Add multiple VMs into a Virtual Machine Scale Set	This template will create N number of VM's with managed disks, public IPs and network interfaces. It will create the VMs in a Virtual Machine Scale Set in Flexible Orchestration mode. They will be provisioned in a Virtual Network which will also be created as part of the deployment
AKS Cluster with a NAT Gateway and an Application Gateway	This sample shows how to a deploy an AKS cluster with NAT Gateway for outbound connections and an Application Gateway for inbound connections.
AKS cluster with the Application Gateway Ingress Controller	This sample shows how to deploy an AKS cluster with Application Gateway, Application Gateway Ingress Controller, Azure Container Registry, Log Analytics and Key Vault
Apache Webserver on Ubuntu VM	This template uses the Azure Linux CustomScript extension to deploy an Apache web server. The deployment template creates an Ubuntu VM, installs Apache2 and creates a simple HTML file. Go to ../demo.html to see the deployed page.
App Gateway with WAF, SSL, IIS and HTTPS redirection