Design and Implement Azure Network Security Services
Network security groups
NSG rules run from the lowest priority number upward, are stateful (return traffic is automatically allowed), and end with default rules at 65000–65500 that allow VNet and Azure Load Balancer traffic and deny inbound internet traffic. An NSG can attach to a subnet and to a NIC; inbound is evaluated subnet first, then NIC, and outbound is the reverse - a rule blocked at either level blocks the flow. Service tags such as VirtualNetwork, AzureLoadBalancer, Internet and Storage keep rules maintainable, and application security groups let you group NICs by role instead of by IP.
Azure Firewall
Azure Firewall is a managed, stateful, centralised filter offering NAT, network and application rules, FQDN filtering, threat intelligence and full logging, with Basic, Standard and Premium tiers (Premium adds TLS inspection and IDPS). It deploys into AzureFirewallSubnet, and forced tunnelling needs AzureFirewallManagementSubnet. To steer spoke egress through the firewall, add a UDR for 0.0.0.0/0 with next hop VirtualAppliance pointing at the firewall's private IP; without that UDR, spokes go straight to the internet.
Supporting controls
DDoS Protection Standard adds adaptive tuning, attack analytics and cost protection and is enabled per VNet. Azure Bastion provides RDP/SSH over TLS without public IPs on VMs and requires AzureBastionSubnet.
Worked example: a spoke subnet must reach only *.contoso.com on HTTPS through a central egress point. An NSG cannot express FQDNs, so route 0.0.0.0/0 from the spoke to Azure Firewall and write an application rule allowing those FQDNs. Rule of thumb: NSG for cheap layer 3/4 segmentation; Azure Firewall when you need FQDN awareness, centralised logging, or cross-VNet chokepoints.