Managing Classic Cloud Service Traffic with Azure Network Security Groups

What Is a Classic Cloud Service?

A classic cloud service in Azure is the original deployment model that predates the Resource Manager (ARM) infrastructure. It hosts multiple virtual machines under a single service name, sharing a virtual network and public IP addresses. Classic services are still supported for legacy workloads, but most new deployments use ARM templates.

Why Use a Network Security Group?

A Network Security Group (NSG) is a stateful firewall that controls inbound and outbound traffic to Azure resources. For classic cloud services, an NSG can be attached to the virtual network or to individual virtual machines, allowing you to define fine‑grained rules for protocols, ports, and IP ranges.

Attaching an NSG to a Classic Service

Unlike ARM resources, classic services cannot have an NSG directly attached to the service itself. Instead, you must:

• Assign the NSG to the virtual network that hosts the classic service.
• Ensure each virtual machine in the service inherits the NSG rules.
• Use service endpoints or private IPs if you need isolated traffic paths.

To apply an NSG to a virtual network:

• Navigate to the Azure portal, select the classic virtual network.
• Choose "Network security groups" and add the desired NSG.
• Save the configuration; changes propagate to all VMs in the network.

Defining NSG Rules for Classic Services

NSG rules follow a priority‑based evaluation. Lower numbers have higher precedence. Typical rules for a classic cloud service might include:

Always place a broad deny rule at the end to block unwanted traffic. Remember that NSGs are stateful: an allowed outbound connection automatically permits the corresponding inbound response.

Best Practices for Classic Cloud Service Security

Use separate VMs for critical roles. Isolate web, database, and management tiers to limit lateral movement.

Leverage application security groups. In classic environments, you can tag VMs and reference those tags in NSG rules to simplify management.

Enable logging. Route NSG flow logs to Azure Storage or Log Analytics for audit and troubleshooting.

Apply least‑privilege principles. Only open ports that are necessary for operation; close everything else.

Migrating to ARM for Enhanced NSG Features

While NSGs work with classic services, ARM offers richer capabilities such as network virtual appliances, advanced threat protection, and integrated diagnostics. If you plan long‑term growth, consider migrating the classic service to a resource group and applying NSGs directly to NICs or subnets for tighter control.