create-associate-nsg

type	skill
lifecycle	stable
inheritance	inheritable
name	create-associate-nsg
description	Creates a new Network Security Group and associates it with the specified subnets and/or NICs of a Virtual Network.
tier	standard
applyTo	**/*create*,**/*associate*,**/*nsg*
currency	2026-04-30T00:00:00.000Z
lastReviewed	2026-04-30T00:00:00.000Z

Skill: Create and Associate NSG

Creates a new Network Security Group and associates it with the specified subnets and/or NICs of a Virtual Network. Typically run after the NSG Lookup for VNet skill identifies unprotected resources.

Required inputs: VNet name, VNet resource group, subscription ID, new NSG name, Azure region/location.
Optional inputs: List of subnet names to associate, list of NIC names (with their resource groups) to associate. If not specified, the skill associates with all subnets and NICs that currently have no NSG.

---

Pre-flight Check

Before creating anything, show the user what will be changed:

Set-AzContext -SubscriptionId "<SUBSCRIPTION_ID>"
$vnet = Get-AzVirtualNetwork -Name "<VNET_NAME>" -ResourceGroupName "<VNET_RESOURCE_GROUP>"

# Subnets without an NSG
$unprotectedSubnets = $vnet.Subnets | Where-Object { -not $_.NetworkSecurityGroup }
$unprotectedSubnets | Select-Object Name, AddressPrefix | Format-Table -AutoSize

# NICs without an NSG (scoped to subnets of this VNet)
$allSubnetIds = $vnet.Subnets.Id
$unprotectedNics = Get-AzNetworkInterface | Where-Object {
    ($_.IpConfigurations | Where-Object { $allSubnetIds -contains $_.Subnet.Id }) -and
    (-not $_.NetworkSecurityGroup)
}
$unprotectedNics | Select-Object Name, ResourceGroupName | Format-Table -AutoSize

Present a confirmation prompt:

The following will be created and associated:

• New NSG: <NSG_NAME> in resource group <RESOURCE_GROUP>, location <LOCATION>
• Subnets to associate: (list)
• NICs to associate: (list)

Proceed? (yes / no)

Do NOT continue until the user confirms.

---

Step 1 — Create the NSG

Set-AzContext -SubscriptionId "<SUBSCRIPTION_ID>"
$nsg = New-AzNetworkSecurityGroup `
    -Name "<NSG_NAME>" `
    -ResourceGroupName "<RESOURCE_GROUP>" `
    -Location "<LOCATION>"

Write-Output "Created NSG: $($nsg.Id)"

If the command fails, show the error and stop.

---

Step 2 — Associate with Subnets

For each subnet to associate, update the subnet config on the VNet and commit:

$vnet = Get-AzVirtualNetwork -Name "<VNET_NAME>" -ResourceGroupName "<VNET_RESOURCE_GROUP>"

foreach ($subnetName in @("<SUBNET_NAME_1>", "<SUBNET_NAME_2>")) {
    $subnet = $vnet.Subnets | Where-Object { $_.Name -eq $subnetName }

    if ($subnet.NetworkSecurityGroup) {
        Write-Warning "Subnet '$subnetName' already has NSG '$($subnet.NetworkSecurityGroup.Id.Split('/')[-1])' — skipping."
        continue
    }

    Set-AzVirtualNetworkSubnetConfig `
        -Name $subnetName `
        -VirtualNetwork $vnet `
        -AddressPrefix $subnet.AddressPrefix `
        -NetworkSecurityGroup $nsg | Out-Null

    Write-Output "Staged NSG association for subnet: $subnetName"
}

# Commit all subnet changes in one call
$vnet | Set-AzVirtualNetwork | Out-Null
Write-Output "Committed subnet NSG associations."