lookup-nsg-for-vnet

name	lookup-nsg-for-vnet
description	Checks every subnet in a Virtual Network for an associated Network Security Group, and also inspects each NIC attached to those subnets for NIC-level NSG coverage.
lastReviewed	2026-04-30T00:00:00.000Z

Skill: NSG Lookup for VNet

Checks every subnet in a Virtual Network for an associated Network Security Group, and also inspects each NIC attached to those subnets for NIC-level NSG coverage. Produces a full coverage report to identify unprotected resources.

Required inputs: VNet name, resource group, subscription ID.

---

Step 1 — Set Azure Context and Get VNet

Run via PowerShell:

Set-AzContext -SubscriptionId "<SUBSCRIPTION_ID>"
$vnet = Get-AzVirtualNetwork -Name "<VNET_NAME>" -ResourceGroupName "<RESOURCE_GROUP>"

If $vnet is null, tell the user the VNet was not found and ask them to verify the name, resource group, and subscription.

---

Step 2 — Check NSG Association for Each Subnet

Run via PowerShell:

$subnetReport = $vnet.Subnets | ForEach-Object {
    $nsgName = if ($_.NetworkSecurityGroup) { $_.NetworkSecurityGroup.Id.Split('/')[-1] } else { $null }
    [PSCustomObject]@{
        SubnetName    = $_.Name
        AddressPrefix = $_.AddressPrefix -join ', '
        NSGAssociated = if ($nsgName) { 'Yes' } else { 'No' }
        NSGName       = if ($nsgName) { $nsgName } else { '— None —' }
        NSGResourceId = if ($_.NetworkSecurityGroup) { $_.NetworkSecurityGroup.Id } else { '—' }
    }
}
$subnetReport | Format-Table -AutoSize

---

Step 3 — Check NSG Association for Each NIC in the VNet

For each subnet, find all NICs whose primary IP configuration is attached to that subnet. Run via PowerShell:

$nicReport = @()
foreach ($subnet in $vnet.Subnets) {
    $nicsInSubnet = Get-AzNetworkInterface -ResourceGroupName "<RESOURCE_GROUP>" | Where-Object {
        $_.IpConfigurations | Where-Object { $_.Subnet.Id -eq $subnet.Id }
    }
    foreach ($nic in $nicsInSubnet) {
        $nicNsgName = if ($nic.NetworkSecurityGroup) { $nic.NetworkSecurityGroup.Id.Split('/')[-1] } else { $null }
        $nicReport += [PSCustomObject]@{
            SubnetName    = $subnet.Name
            NICName       = $nic.Name
            ResourceGroup = $nic.ResourceGroupName
            NSGAssociated = if ($nicNsgName) { 'Yes' } else { 'No' }
            NSGName       = if ($nicNsgName) { $nicNsgName } else { '— None —' }
        }
    }
}
$nicReport | Format-Table -AutoSize

---

Step 4 — Present Coverage Report

Output two summary tables:

Subnet NSG Coverage

Subnet Name	Address Prefix	NSG Associated	NSG Name
(name)	(cidr)	Yes / No	(name or — None —)

NIC NSG Coverage

Subnet Name	NIC Name	Resource Group	NSG Associated	NSG Name
(subnet)	(nic)	(rg)	Yes / No	(name or — None —)

Coverage Summary

Report counts:

• Total subnets: N
• Subnets with NSG: N
• Subnets without NSG: N ⚠️
• Total NICs: N
• NICs with NIC-level NSG: N
• NICs without NIC-level NSG: N (note: covered by subnet NSG if subnet has one)

---

Step 5 — Flag Unprotected Resources

If any subnet has no NSG, warn:

⚠️ Subnet <name> has no NSG. All traffic to/from this subnet is unrestricted. This may trigger [SFI-NS2.5.1] Overexposed Endpoints.

If a NIC has no NSG and its subnet also has no NSG, warn:

⚠️ NIC <name> is fully unprotected — neither the NIC nor its subnet (<subnet>) has an NSG associated.

Pass the list of unprotected subnets and NICs to the Create and Associate NSG skill if remediation is needed.

---

Safety Rules

• ⚠️ This skill is read-only — it makes no changes
• ⚠️ Get-AzNetworkInterface without filters queries all NICs in the subscription; in large subscriptions consider scoping with -ResourceGroupName if the VNet and NICs share a resource group