Manage network security groups on Azure Local multi-rack deployments

• You must have access to a multi-rack deployment.

  • This instance has a custom location.
  • You have access to an Azure subscription with the appropriate Role-based access control (RBAC) role and permissions assigned. For more information, see Assign Azure Local RBAC roles.
  • This instance has at least one network security group created and configured with a network security rule. For more information, see Create a network security group.
  • If using a client to connect to your instance, ensure you've installed the latest Azure CLI and the stack-hci-vm extension. For more information, see Azure Local VM management prerequisites.

• You must have access to a multi-rack deployment.

  • This instance has a custom location.
  • You have access to an Azure subscription with the appropriate Role-based access control (RBAC) role and permissions assigned. For more information, see Assign Azure Local RBAC roles.

Sign in and set subscription

1. Connect to a machine on your Azure Local instance.

2. Sign in and enter the following command:

   az login --use-device-code
   

3. Set your subscription.

   az account set --subscription <Subscription ID>
   

Manage network security groups

This section describes the manage operations supported for network security groups.

List network security groups

Follow these steps to list network security groups:

1. Set the following parameters in your Azure CLI session.

   $resourceGroup = "mylocal-rg"
   $nsgname = "examplensg"
   

2. Run the following command to list network security groups on your Azure Local instance.

   az stack-hci-vm network nsg list -g $resourceGroup
   

   Expand this section to see an example output.

   [
     {
       "eTag": null,
       "extendedLocation": {
         "name": "/subscriptions/<Subscription ID>/resourcegroups/<Resource Group Name>/providers/microsoft
   .extendedlocation/customlocations/mylocal-cl",
         "type": "CustomLocation"
       },
       "id": "/subscriptions/<Subscription ID>/resourceGroups/<Resource Group Name>/providers/Microsoft.Azu
   reStackHCI/networkSecurityGroups/examplensg",
       "location": "eastus",
       "name": "examplensg",
       "properties": {
         "networkInterfaces": [],
         "provisioningState": "Succeeded",
         "subnets": []
       },
       "resourceGroup": "mylocal-rg",
       "systemData": {
         "createdAt": "2025-04-24T17:33:49.304682+00:00",
         "createdBy": "user@contoso.com",
         "createdByType": "User",
         "lastModifiedAt": "2025-04-24T17:34:00.133215+00:00",
         "lastModifiedBy": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
         "lastModifiedByType": "Application"
       },
       "tags": {},
       "type": "microsoft.azurestackhci/networksecuritygroups"
     }
   ]
   

Show details of a network security group

Follow these steps to show details of a network security group:

1. Set the following parameters in your Azure CLI session.

   $resourceGroup = "mylocal-rg"
   $nsgname = "examplensg"
   

2. Run the following command to show details of a network security group (NSG) on your Azure Local instance.

   az stack-hci-vm network nsg show -g $resourceGroup --name $nsgname 
   

3. The command outputs the details of a specified network security group (NSG).

   • In this example, the NSG has no network interface attached.

     Expand this section to see an example output.

     {
       "eTag": null,
       "extendedLocation": {
         "name": "/subscriptions/<Subscription ID>/resourcegroups/mylocal-rg/providers/microsoft.extendedlocation/customlocations/mylocal-cl",
         "type": "CustomLocation"
       },
       "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkSecurityGroups/examplensg",
       "location": "eastus",
       "name": "examplensg",
       "properties": {
         "networkInterfaces": [],
         "provisioningState": "Succeeded",
         "subnets": []
       },
       "resourceGroup": "mylocal-rg",
       "systemData": {
         "createdAt": "2025-03-11T22:56:05.968402+00:00",
         "createdBy": "user@contoso.com",
         "createdByType": "User",
         "lastModifiedAt": "2025-03-11T22:56:13.438321+00:00",
         "lastModifiedBy": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
         "lastModifiedByType": "Application"
       },
       "tags": null,
       "type": "microsoft.azurestackhci/networksecuritygroups"
     }        
     

   • In this example, the NSG has a network interface attached.

     Expand this section to see an example output.

     {
       "eTag": null,
       "extendedLocation": {
         "name": "/subscriptions/<Subscription ID>/resourcegroups/mylocal-rg/providers/microsoft.extendedlocation/customlocations/mylocal-cl",
         "type": "CustomLocation"
       },
       "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkSecurityGroups/examplensg",
       "location": "eastus",
       "name": "examplensg",
       "properties": {
         "networkInterfaces": [
           {
             "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkInterfaces/examplenic",
             "resourceGroup": "mylocal-rg"
           }
         ],
         "provisioningState": "Succeeded",
         "subnets": []
       },
       "resourceGroup": "mylocal-rg",
       "systemData": {
         "createdAt": "2025-03-11T22:56:05.968402+00:00",
         "createdBy": "user@contoso.com",
         "createdByType": "User",
         "lastModifiedAt": "2025-03-12T15:49:32.419759+00:00",
         "lastModifiedBy": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
         "lastModifiedByType": "Application"
       },
       "tags": null,
       "type": "microsoft.azurestackhci/networksecuritygroups"
     }       
     

Delete a network security group

Follow these steps to delete a network security group:

1. Set the following parameters in your Azure CLI session.

   $resourceGroup = "mylocal-rg"
   $nsgname = "examplensg"
   

2. Run the following command to delete a network security group (NSG) on your Azure Local instance.

   az stack-hci-vm network nsg delete -g $resourceGroup --name $nsgname --yes
   

   Use the list command to verify that the NSG is deleted.

Associate network security group with network interface

In this example, we create a network interface with an existing network security group in one step. The IP address for the network interface is optional and isn't passed in this example. If you don't pass the IP address, the system assigns a random IP address from the subnet.

1. Set the following parameters in your Azure CLI session.

   $resourceGroup = "mylocal-rg"
   $location = "eastus"
   $customLocationID = "<custom location ARM resource ID>"
   $nsgname = "examplensg"
   $lnetname="static-lnet" 
   $nicname="examplenic" 
   

2. Run the following command to create a network interface (NIC) on your Azure Local instance.

   az stack-hci-vm network nic create --resource-group $resourceGroup --custom-location $customLocationID --location $location --subnet-id $lnetname --name $nicname --network-security-group $nsgname 
   

   Expand this section to see an example output.

   { 
   
     "extendedLocation": { 
       "name": "/subscriptions/<Subscription ID>/resourcegroups/mylocal-rg/providers/microsoft.extendedlocation/customlocations/mylocal-cl", 
       "type": "CustomLocation" 
     }, 
   
     "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkInterfaces/examplenic", 
     "location": "eastus", 
     "name": "examplenic", 
     "properties": { 
       "dnsSettings": null, 
       "ipConfigurations": [ 
         { 
           "name": null, 
           "properties": { 
             "gateway": "100.78.98.1", 
             "prefixLength": "24", 
             "privateIpAddress": "100.78.98.224", 
             "subnet": { 
               "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/logicalNetworks/static-lnet", 
               "resourceGroup": "mylocal-rg" 
             } 
           } 
         } 
       ], 
   
       "macAddress": "<Mac Address>", 
       "networkSecurityGroup": { 
         "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkSecurityGroups/examplensg", 
         "resourceGroup": "mylocal-rg" 
       }, 
   
       "provisioningState": "Succeeded", 
       "status": { 
         "errorCode": null, 
         "errorMessage": null, 
         "provisioningStatus": null 
       } 
     }, 
   
     "resourceGroup": "mylocal-rg", 
     "systemData": { 
       "createdAt": "2025-03-11T23:38:19.228090+00:00", 
       "createdBy": "user@contoso.com", 
       "createdByType": "<User>", 
       "lastModifiedAt": "2025-03-12T15:49:32.143520+00:00", 
       "lastModifiedBy": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", 
       "lastModifiedByType": "Application" 
     }, 
   
     "tags": null, 
     "type": "microsoft.azurestackhci/networkinterfaces" 
   } 
   
   

Associate network security group with logical network

In this example, we associate a static logical network with an existing network security group. No IP pools are passed in this example as they're optional.

1. Set the following parameters in your Azure CLI session.

   $resourceGroup = "mylocal-rg"
   $location = "eastus"
   $customLocationID = "<custom location ARM resource ID>"
   $nsgname = "examplensg"
   $lnetname="static-lnet3" 
   $ipaddprefix="100.78.98.0/24" 
   $dnsservers="100.71.93.111" 
   $gateway="100.78.98.1" 
   $vlan="301"
   $fabricResourceID = "<L3 ISD internal network ARM ID>"
   

2. Run the following command to associate a logical network with a network security group on your Azure Local instance.

   az stack-hci-vm network lnet create --resource-group $resourceGroup --custom-location $customLocationID --location $location --name $lnetname --ip-allocation-method "static" --address-prefixes $ipaddprefix --dns-servers $dnsservers --gateway $gateway --vlan $vlan --network-security-group $nsgname --fabric-network-configuration-id $fabricResourceID
   

   Expand this section to see an example output.

   { 
   
     "extendedLocation": { 
   
       "name": "/subscriptions/<Subscription ID>/resourcegroups/mylocal-rg/providers/microsoft.extendedlocation/ 
   
   customlocations/mylocal-cl", 
   
       "type": "CustomLocation" 
   
     }, 
   
     "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/logicalNetworks/static-lnet3", 
     "location": "eastus", 
     "name": "static-lnet3", 
     "properties": { 
       "dhcpOptions": { 
         "dnsServers": [ 
           "100.71.93.111" 
         ] 
       }, 
   
       "fabricNetworkConfiguration": {
         "resourceId": "/subscriptions/<Subscription ID>/resourceGroups/<Resource Group>/providers/Microsoft.ManagedNetworkFabric/l3IsolationDomains/<L3 Isolation Domain>/internalNetworks/<Internal Network>"
       },
       "provisioningState": "Succeeded",
       "status": { 
         "errorCode": "", 
         "errorMessage": "", 
         "provisioningStatus": null 
       }, 
   
       "subnets": [ 
         { 
           "name": "static-lnet3", 
           "properties": { 
             "addressPrefix": "100.78.98.0/24", 
             "addressPrefixes": null, 
             "ipAllocationMethod": "Static", 
             "ipConfigurationReferences": null, 
             "ipPools": [ 
   
               { 
                 "end": "100.78.98.255", 
                 "info": { 
                   "available": "256", 
                   "used": "0" 
                 }, 
   
                 "ipPoolType": null, 
                 "name": null, 
                 "start": "100.78.98.0" 
               } 
             ], 
   
             "networkSecurityGroup": { 
               "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkSecurityGroups/examplensg3", 
   
               "resourceGroup": "mylocal-rg" 
   
             }, 
   
             "routeTable": { 
               "etag": null, 
               "name": null, 
               "properties": { 
                 "routes": [ 
   
                   { 
                     "name": null, 
                     "properties": { 
                       "addressPrefix": "0.0.0.0/0", 
                       "nextHopIpAddress": "100.78.98.1" 
                     } 
                   } 
                 ] 
               }, 
   
               "type": null 
   
             }, 
   
             "vlan": 301 
   
           } 
         } 
       ] 
     }, 
   
     "resourceGroup": "mylocal-rg", 
     "systemData": { 
       "createdAt": "2025-03-13T01:04:07.645689+00:00", 
       "createdBy": "user@contoso.com", 
       "createdByType": "User", 
       "lastModifiedAt": "2025-03-13T01:04:15.389109+00:00", 
       "lastModifiedBy": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", 
       "lastModifiedByType": "Application" 
     }, 
   
     "tags": null, 
     "type": "microsoft.azurestackhci/logicalnetworks" 
   } 
   

Dissociate network security group from logical network

You can dissociate a network security group from a logical network. This dissociation allows you to remove the network security rules applied to the logical network.

Follow these steps to dissociate a network security group from logical network:

1. Set the following parameters in your Azure CLI session. Make sure to pass the NSG name as an empty string encased in double quotes followed by single quotes ('""').

   $resourceGroup = "mylocal-rg"
   $location = "eastus"
   $customLocationID = "<custom location ARM resource ID>"
   $nsgname = '""'
   $lnetname="static-lnet3" 
   

2. To dissociate a network security group from a logical network, run the following command:

   az stack-hci-vm network lnet update -g $resourceGroup --name $lnetname --network-security-group '""'
   

   Expand this section to see an example output.

   {
     "extendedLocation": {
       "name": "/subscriptions/<Subscription ID>/resourcegroups/<Resource Group Name>/providers/microsoft.extendedlocation/customlocations/mylocal-cl",
       "type": "CustomLocation"
     },
     "id": "/subscriptions/<Subscription ID>/resourceGroups/<Resource Group Name>/providers/microsoft.azurestackhci/logicalnetworks/static-lnet2",
     "location": "eastus",
     "name": "static-lnet2",
     "properties": {
       "dhcpOptions": {
         "dnsServers": [
           "100.71.84.238"
         ]
       },
       "provisioningState": "Succeeded",
       "subnets": [
         {
           "name": "static-lnet2",
           "properties": {
             "addressPrefix": "100.69.174.0/24",
             "addressPrefixes": null,
             "ipAllocationMethod": "Static",
             "ipConfigurationReferences": [
               {
                 "id": "/subscriptions/<Subscription ID>/resourceGroups/<Resource Group Name>/providers/Microsoft.AzureStackHCI/networkInterfaces/sdnbbnic-01",
                 "resourceGroup": "<Resource Group Name>"
               }
             ],
             "ipPools": [
               {
                 "end": "100.69.174.126",
                 "info": {
                   "available": "30",
                   "used": "1"
                 },
                 "ipPoolType": null,
                 "name": null,
                 "start": "100.69.174.96"
               }
             ],
             "networkSecurityGroup": {
               "id": null
             },
             "routeTable": {
               "etag": null,
               "name": null,
               "properties": {
                 "routes": [
                   {
                     "name": null,
                     "properties": {
                       "addressPrefix": "0.0.0.0/0",
                       "nextHopIpAddress": "100.69.174.1"
                     }
                   }
                 ]
               },
               "type": null
             },
             "vlan": 301
           }
         }
       ]
     },
     "resourceGroup": "<Resource Group Name>",
     "systemData": {
       "createdAt": "2025-06-08T16:46:38.085581+00:00",
       "createdBy": "user@contoso.com",
       "createdByType": "User",
       "lastModifiedAt": "2025-06-09T13:45:08.531262+00:00",
       "lastModifiedBy": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
       "lastModifiedByType": "Application"
     },
     "tags": {},
     "type": "microsoft.azurestackhci/logicalnetworks"
   }
   

Dissociate network security group from network interface

You can dissociate a network security group from a network interface. This dissociation allows you to remove the network security rules applied to the network interface.

Follow these steps to dissociate a network security group from a network interface card:

1. Set the following parameters in your Azure CLI session.

   $resourceGroup = "mylocal-rg"
   $location = "eastus"
   $customLocationID = "<custom location ARM resource ID>"
   $nsgname = '""'
   $nicname ="examplenic" 
   

2. To dissociate a network security group from a network interface, run the following command:

   az stack-hci-vm network nic update -g $resourceGroup --name $nicname --network-security-group $nsgname
   

</details>


## Manage network security rules

This section describes the manage operations supported for network security rules.

### Show details of a network security rule

1. Set the following parameters in your Azure CLI session:

  ```azurecli
  $resourceGroup = "mylocal-rg"
  $location = "eastus"
  $customLocationID = "<custom location ARM resource ID>"
  $nsgname = "examplensg"
  $securityrulename = "examplerule"
  ```

1. Run this command to show details of a network security rule:

  ```azurecli
  az stack-hci-vm network nsg rule show -g $resourceGroup -n $securityrulename --nsg-name $nsgname
  ```

  <details>
  <summary>Expand this section to see an example output.</summary>
  
  ```output
  
  {
    "extendedLocation": {
      "name": "/subscriptions/{Subscription ID}/resourcegroups/mylocal-rg/providers/microsoft.extendedlocation/customlocations/mylocal-cl",
      "type": "CustomLocation"
    },
    "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkSecurityGroups/examplensg/securityRules/examplensr",
    "name": "examplensr",
    "properties": {
      "access": "Deny",
      "description": "Inbound security rule",
      "destinationAddressPrefixes": [
        "192.168.99.0/24"
      ],
      "destinationPortRanges": [
        "80"
      ],
      "direction": "Inbound",
      "priority": 400,
      "protocol": "Icmp",
      "provisioningState": "Succeeded",
      "sourceAddressPrefixes": [
        "10.0.0.0/24"
      ],
      "sourcePortRanges": [
        "*"
      ]
    },
    "resourceGroup": "mylocal-rg",
    "systemData": {
      "createdAt": "2025-03-11T23:25:37.369940+00:00",
      "createdBy": "user@contoso.com",
      "createdByType": "User",
      "lastModifiedAt": "2025-03-11T23:25:37.369940+00:00",
      "lastModifiedBy": "user@contoso.com",
      "lastModifiedByType": "User"
    },
    "type": "microsoft.azurestackhci/networksecuritygroups/securityrules"
  }
  
  ```

  </details>

### Update a network security rule

1. Set the following parameters in your Azure CLI session.

  ```azurecli
  $resourceGroup = "mylocal-rg"
  $location = "eastus"
  $customLocationID = "<custom location ARM resource ID>"
  $nsgname = "examplensg"
  $securityrulename = "examplensr"
  $destinationport = "80"
  ```

1. Run this command to update a network security rule:

  ```azurecli
  az stack-hci-vm network nsg rule update --name $securityrulename --nsg-name $nsgname --resource-group $resourceGroup --destination-port-ranges $destinationport
  ```

  <details>
  <summary>Expand this section to see an example output.</summary>
  
  ```output
  {
    "extendedLocation": {
      "name": "/subscriptions/{Subscription ID}/resourcegroups/mylocal-rg/providers/microsoft.extendedlocation/customlocations/mylocal-cl",
      "type": "CustomLocation"
    },
    "id": "/subscriptions/<Subscription ID>/resourceGroups/mylocal-rg/providers/Microsoft.AzureStackHCI/networkSecurityGroups/examplensg/securityRules/examplensr",
    "name": "examplensr",
    "properties": {
      "access": "Allow",
      "description": "This NSG is intended to allow traffic from any source IP/port range to hit any destination IP/port range",
      "destinationAddressPrefixes": [
        "*"
      ],
      "destinationPortRanges": [
        "80"
      ],
      "direction": "Inbound",
      "priority": 100,
      "protocol": "*",
      "provisioningState": "Succeeded",
      "sourceAddressPrefixes": [
        "*"
      ],
      "sourcePortRanges": [
        "*"
      ]
    },
    "resourceGroup": "mylocal-rg",
    "systemData": {
      "createdAt": "2025-04-24T17:37:24.766786+00:00",
      "createdBy": "user@contoso.com",
      "createdByType": "User",
      "lastModifiedAt": "2025-04-24T18:21:13.803650+00:00",
      "lastModifiedBy": "user@contoso.com",
      "lastModifiedByType": "User"
    },
    "type": "microsoft.azurestackhci/networksecuritygroups/securityrules"
  }

  ```

  </details>

### List network security rules in a network security group

Run this command to list network security rules in a network security group:

```azurecli
az stack-hci-vm network nsg rule list --resource-group "<Resource group name>" --nsg-name "<NSG name>"

{
    "extendedLocation": {
      "name": "/subscriptions/{Subscription ID}/resourcegroups/{Resource Group Name}/providers/microsoft.extendedlocation/customlocations/mylocal-cl",
      "type": "CustomLocation"
    },
    "id": "/subscriptions/{Subscription ID}/resourceGroups/{Resource Group Name}/providers/Microsoft.AzureStackHCI/networkSecurityGroups/examplensg/securityRules/contoso-retail-any-any-rule",
    "name": "contoso-retail-any-any-rule",
    "properties": {
      "access": "Allow",
      "description": "This NSG is intended to allow traffic from any source IP/port range to hit any destination IP/port range",
      "destinationAddressPrefixes": [
        "*"
      ],
      "destinationPortRanges": [
        "80"
      ],
      "direction": "Inbound",
      "priority": 100,
      "protocol": "*",
      "provisioningState": "Succeeded",
      "sourceAddressPrefixes": [
        "*"
      ],
      "sourcePortRanges": [
        "*"
      ]
    },
    "resourceGroup": "{Resource Group Name}",
    "systemData": {
      "createdAt": "2025-04-24T17:37:24.766786+00:00",
      "createdBy": "user@contoso.com",
      "createdByType": "User",
      "lastModifiedAt": "2025-04-24T18:21:13.803650+00:00",
      "lastModifiedBy": "user@contoso.com",
      "lastModifiedByType": "User"
    },
    "type": "microsoft.azurestackhci/networksecuritygroups/securityrules"
  }

This section describes the manage operations supported for network security groups and network security rules. These operations are available in the Azure portal.

List network security groups

Go to Azure Local resource page > Resources > Network security groups. You see a list of network security groups present on your Azure Local.

Associate network security group with a logical network

You can associate a network security group with a logical network. This association allows you to apply the same network security rules to all the VMs in the logical network.

To associate a network security group with a logical network, follow these steps in Azure portal:

1. Go to Azure Local resource page > Resources > Logical networks.

2. In the right pane, from the list of logical networks, select a network.

   

3. Go to Settings > Network security groups.

4. In the right-pane, from the top command bar, select + Associate network security group.

   

5. In the Associate network security group page:

   

   1. From the dropdown, select a network security group.
   2. Select Add network security group. The operation takes a few minutes to complete. You can see the status of the operation in the Notifications pane.

   Once the network security group is associated with the logical network, you can see the network security group in the Network security groups tab of the logical network.

Dissociate network security group from a logical network

You can dissociate a network security group from a logical network.

To dissociate a network security group from a logical network, follow these steps:

1. Go to Azure Local resource page > Resources > Logical networks.

2. In the right pane, from the list of logical networks, select a network.

   

3. Go to Settings > Network security groups.

4. In the right-pane, from the top command bar, select Dissociate network security group.

   

5. Confirm the dissociation.

The operation takes a few minutes to complete. You can see the status of the operation in the Notifications pane. Once the network security group is dissociated from the logical network, the page refreshes to indicate the dissociation.

Associate network security group with a network interface

You can associate a network security group with a network interface. This association allows you to apply the same network security rules to all the VMs in the logical network.

To associate a network security group with a network interface, follow these steps:

1. Go to Azure Local resource page > Resources > Network interfaces.

2. In the right pane, from the list of network interfaces, select a network interface.

   

3. Go to Settings > Network security group.

4. In the right-pane, from the top command bar, select + Associate network security group.

   

5. In the Associate network security group page, input the following information:

   

   1. Network security group - Select a network security group from the list of network security groups available in your Azure Local instance.
   2. Select Associate network security group. The operation takes a few minutes to complete. You can see the status of the operation in the Notifications pane.

Dissociate network security group from a network interface

You can dissociate a network security group from a network interface.

To dissociate a network security group from a network interface, follow these steps:

1. Go to Azure Local resource page > Resources > Network interfaces.

   

2. In the right pane, from the list of network interfaces, select an interface that has a network security group attached to it.

3. Go to Settings > Network security groups.

4. In the right-pane, from the top command bar, select Dissociate network security group.

   

5. Confirm the dissociation.

   

The operation takes a few minutes to complete. You can see the status of the operation in the Notifications pane. After the network security group is dissociated from the network interface, the page refreshes to indicate the dissociation.

List network security rules in a network security group

To list network security rules in a network security group, follow these steps:

1. Go to Azure Local resource page > Resources > Network security groups.
2. In the right pane, from the list of network security groups, select a network security group.
3. In the right pane, from the list of network security rules, select a network security rule. The details of the network security rule are displayed in the right pane.

Update a network security rule

To update a network security rule, follow these steps:

1. Go to Azure Local resource page > Resources > Network security groups.
2. In the right pane, from the list of network security groups, select a network security group.
3. In the right pane, from the list of network security rules, select a network security rule.
4. In the right pane, the Edit network security rule page opens.
5. Update the required fields and select Save. The operation takes a few minutes to complete. You can see the status of the operation in the Notifications pane.
6. Once the network security rule is updated, the page refreshes to indicate the update.