A subnet with no filter. An NSG rule wide open to the internet. Neither shows up on its own.
A subnet with no Network Security Group attached has no traffic filter of its own: anything reachable from that subnet can reach it back, with no deliberate policy in between. It's an easy control to set up correctly when a subnet is first created, and just as easy to skip on a new subnet added later under deadline pressure. Even where an NSG does exist, a single rule with a wildcard source and a wildcard port undoes it in practice, letting traffic in from anywhere on any port despite the NSG's own deny-all baseline underneath. And a virtual network with public-facing resources but no DDoS Protection Standard attached relies entirely on Azure's basic always-on protection, with none of the adaptive tuning a real attack would benefit from. ID Posture checks all of it, subnet by subnet and rule by rule, across every connected subscription.
Six findings, checked on every scan
Ask your ID Posture contact to enable Networking for your tenant.
Why it matters
A Network Security Group is the difference between "anything on this subnet can reach the internet, and be reached from it" and an actual, deliberate traffic policy. It's easy to attach one when a subnet is first created and just as easy to forget when a new one gets added six months later under deadline pressure. But an NSG existing isn't the whole story: Azure keeps an immutable deny-all rule at the bottom of every NSG already, and a single custom rule with a wildcard source and a wildcard port bypasses that baseline for all traffic, in practice leaving the NSG no better than not having one. A narrower wildcard rule (any source on one port, or one source on any port) is a smaller but still real hygiene gap. An NSG that isn't attached to anything at all is its own quiet problem: whoever reviews its rules may believe they describe live protection when they describe nothing. And DDoS Protection Standard is the one control here that isn't about traffic filtering at all -- it's what stands between a public-facing resource and a volumetric attack. ID Posture checks all six on every scan, and also surfaces a plain inventory of your VNets and subnets (peering, DNS type, route tables, service endpoints) alongside the findings, so you can see the full picture, not just the flagged issues.
Part of ID Posture’s broader Azure resource coverage. See the full product overview, or explore Key Vault and Storage Security.
It's optional, per tenant, and off by default until you ask for it.