lookup-nsg-for-vnet

type	skill
lifecycle	stable
inheritance	inheritable
name	lookup-nsg-for-vnet
description	Checks every subnet in a Virtual Network for an associated Network Security Group, and also inspects each NIC attached to those subnets for NIC-level NSG coverage.
tier	standard
applyTo	**/*lookup*,**/*nsg*,**/*for*
currency	2026-04-30T00:00:00.000Z
lastReviewed	2026-04-30T00:00:00.000Z

Skill: NSG Lookup for VNet

Checks every subnet in a Virtual Network for an associated Network Security Group, and also inspects each NIC attached to those subnets for NIC-level NSG coverage. Produces a full coverage report to identify unprotected resources.

Required inputs: VNet name, resource group, subscription ID.

---

Step 1 — Set Azure Context and Get VNet

Run via PowerShell:

Set-AzContext -SubscriptionId "<SUBSCRIPTION_ID>"
$vnet = Get-AzVirtualNetwork -Name "<VNET_NAME>" -ResourceGroupName "<RESOURCE_GROUP>"

If $vnet is null, tell the user the VNet was not found and ask them to verify the name, resource group, and subscription.

---

Step 2 — Check NSG Association for Each Subnet

Run via PowerShell:

$subnetReport = $vnet.Subnets | ForEach-Object {
    $nsgName = if ($_.NetworkSecurityGroup) { $_.NetworkSecurityGroup.Id.Split('/')[-1] } else { $null }
    [PSCustomObject]@{
        SubnetName    = $_.Name
        AddressPrefix = $_.AddressPrefix -join ', '
        NSGAssociated = if ($nsgName) { 'Yes' } else { 'No' }
        NSGName       = if ($nsgName) { $nsgName } else { '— None —' }
        NSGResourceId = if ($_.NetworkSecurityGroup) { $_.NetworkSecurityGroup.Id } else { '—' }
    }
}
$subnetReport | Format-Table -AutoSize

---

Step 3 — Check NSG Association for Each NIC in the VNet

For each subnet, find all NICs whose primary IP configuration is attached to that subnet. Run via PowerShell:

$nicReport = @()
foreach ($subnet in $vnet.Subnets) {
    $nicsInSubnet = Get-AzNetworkInterface -ResourceGroupName "<RESOURCE_GROUP>" | Where-Object {
        $_.IpConfigurations | Where-Object { $_.Subnet.Id -eq $subnet.Id }
    }
    foreach ($nic in $nicsInSubnet) {
        $nicNsgName = if ($nic.NetworkSecurityGroup) { $nic.NetworkSecurityGroup.Id.Split('/')[-1] } else { $null }
        $nicReport += [PSCustomObject]@{
            SubnetName    = $subnet.Name
            NICName       = $nic.Name
            ResourceGroup = $nic.ResourceGroupName
            NSGAssociated = if ($nicNsgName) { 'Yes' } else { 'No' }
            NSGName       = if ($nicNsgName) { $nicNsgName } else { '— None —' }
        }
    }
}
$nicReport | Format-Table -AutoSize

---

Step 4 — Present Coverage Report

Output two summary tables:

Subnet NSG Coverage

Subnet Name	Address Prefix	NSG Associated	NSG Name
(name)	(cidr)	Yes / No