Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
monitor_alert_delete_nsgProvider: Azure
Service:
monitorSeverity: HIGH
Categories:
logging, forensics-readyResource type:
microsoft.insights/activitylogalertsWhat this check verifies
Azure Monitor activity log alerts include the NSG deletion signal (Microsoft.Network/networkSecurityGroups/delete or Microsoft.ClassicNetwork/networkSecurityGroups/delete). The finding indicates whether a subscription has an alert rule configured to trigger when a Network Security Group is deleted.
Risk
Without alerting on NSG deletions, network segmentation can be removed unnoticed, exposing services to broad ingress/egress. Malicious actors or automation may delete NSGs to enable lateral movement and data exfiltration. Missing alerts delay response, impacting confidentiality and availability.Recommendation
Configure a subscription-wide activity log alert for the NSG delete operation (Microsoft.Network/networkSecurityGroups/delete; include Classic if applicable) and route notifications via action groups. Enforce least privilege for NSG changes, require change control, and integrate with your SIEM for correlation.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-in/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule?tabs=activity-log
- https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActivityLog/delete-network-security-group-rule-alert-in-use.html#trendmicro
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = monitor_alert_delete_nsg. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks