NSG vs Azure Firewall: the difference, and why you often want both
A network security group is a free packet filter that reasons about IP addresses and ports. Azure Firewall is a managed service that reasons about names and threats. They are not rivals — they work at different altitudes, and mature networks run both.
New to cloud? CAMPUX is a free, build-first course. Start here →
Newcomers treat "NSG" and "Azure Firewall" as two answers to one question — how do I control traffic? — and then agonise over picking one. That framing is the mistake. They control different things, at different layers, for different reasons. Understanding where each operates makes the "which one" question mostly dissolve.
The NSG: a free, fast filter on the five-tuple
A network security group is a basic packet filter you attach to a subnet or a network interface. It holds allow/deny rules, and each rule is evaluated on what Microsoft calls the five-tuple: source IP, source port, destination IP, destination port, and protocol. Rules run in priority order (lower number wins); the first match decides, and processing stops.
Two properties matter most. First, an NSG is stateful: allow an inbound flow and the return traffic is automatically permitted, so you do not write mirror-image rules for responses. Second, it is free and built into the network fabric, so there is no reason not to use them liberally. What an NSG cannot do is just as important: it works at layers 3 and 4 only. It has no idea what a domain name is, cannot allow "traffic to github.com," and does no application-layer inspection. It sees addresses and ports, nothing more.
Azure Firewall: a managed service that understands names and threats
Azure Firewall is a different class of thing. The docs define it as "a cloud-native, intelligent network firewall security service" — and crucially, "a fully stateful firewall as a service, featuring built-in high availability and unlimited cloud scalability." You do not patch it, scale it, or babysit its uptime; it is a managed appliance you deploy centrally, usually in a hub network that all your other networks route through. Its Standard SKU brings the capabilities an NSG structurally cannot:
- FQDN filtering. Through application rules, it can allow or deny traffic by domain name — "outbound HTTPS may reach
*.microsoft.comand nothing else." That is impossible with an NSG, which only knows IPs. - L3–L7 filtering with both network rules (IP/port, like an NSG) and application rules (names and protocols).
- Threat intelligence. Fed from Microsoft's security signal, it can alert on or block traffic to and from known-malicious IPs and domains, updated in real time.
All of that is why Azure Firewall costs money (billed by deployment and data processed) while an NSG is free. You are paying for a managed, intelligent, centralised control point — not a per-subnet rule list.
| Network security group | Azure Firewall | |
|---|---|---|
| What it is | Built-in packet filter | Managed firewall service |
| Layers | L3 / L4 (five-tuple) | L3–L7 |
| Filter by domain name? | No | Yes (FQDN / app rules) |
| Threat intelligence | No | Yes |
| Stateful | Yes | Yes |
| Attaches to | Subnet or NIC | Central hub network |
| Cost | Free | Paid |
An NSG asks "which address and port?" A firewall asks "which name, and is it dangerous?"
Why real networks run both
Because they operate at different altitudes, the grown-up pattern is defence in depth: Azure Firewall in a central hub controls what enters and leaves the environment — the coarse, intelligent, name-aware perimeter — while NSGs do fine-grained segmentation deep inside, saying which subnets and which specific ports may talk to each other. The firewall keeps malicious domains and unapproved egress out at the edge; the NSGs make sure that even inside the walls, the web subnet can only reach the database subnet on the one port it needs.
You can absolutely run a perfectly secure small environment on NSGs alone — many do, and it is the right, thrifty call when you do not need name-based rules or centralised egress control. But the instant a requirement appears like "we must restrict outbound traffic to an approved list of domains" or "block anything talking to known-bad IPs," you have hit the ceiling of what an NSG can express, and that is Azure Firewall's job.
"An NSG is a free, stateful layer 3/4 filter on the five-tuple, attached to subnets and NICs for segmentation. Azure Firewall is a managed, stateful L3–L7 service with FQDN filtering and threat intelligence, deployed centrally for perimeter control. They are complementary — I use NSGs for internal segmentation and a firewall for the intelligent edge."
The takeaway
Stop asking which one and start asking what am I trying to control? If the answer is "which internal subnet reaches which port," that is an NSG, and it is free — use them everywhere. If the answer involves domain names, centralised egress, or threat feeds, that is Azure Firewall. Most serious environments end up with both, each doing the job the other cannot, and that is not redundancy — it is layers.
Questions people also ask
Can Azure Firewall replace NSG?
No. Azure Firewall handles perimeter and egress control — domain names, application rules, threat intelligence. NSGs handle cheap, fast segmentation between subnets and NICs inside the network. Removing NSGs and relying on one central firewall for every internal hop adds cost and a single choke point for traffic that never needed to leave the subnet.
Do I need both NSG and Azure Firewall?
Most production environments end up running both. Azure Firewall sits in a hub and controls what enters and leaves the environment by name and threat signal. NSGs sit on every subnet and NIC and enforce which internal resources may talk to which, on which port. Small environments with no egress or FQDN requirement can run on NSGs alone.
Is NSG a firewall?
It is a packet filter, not a firewall in the full sense. An NSG evaluates the five-tuple — source IP, source port, destination IP, destination port, protocol — and allows or denies by priority order. It has no concept of a domain name and does no application-layer inspection, which is what separates it from a managed service like Azure Firewall.
What is the five-tuple in an NSG rule?
Source IP, source port, destination IP, destination port, and protocol. An NSG rule matches traffic against these five fields only, in priority order, and the first match wins. Because it carries no application-layer awareness, it cannot allow or deny traffic by domain name — that requires Azure Firewall's application rules instead.
Is Azure Firewall free?
No. Azure Firewall is billed by deployment hour and by data processed, because it is a managed, highly available service you do not patch or scale yourself. An NSG is free and built into the network fabric, which is why the sane default is to use NSGs everywhere and add Azure Firewall only once you need FQDN filtering or threat intelligence.