Application Security Group (ASG)
What it is
An Application Security Group (ASG) is a logical grouping of virtual machines/NICs under one application-centric name so NSG rules can be written against roles (e.g. WebServers, AppServers) instead of individual IPs/CIDRs.
Why it exists
Writing NSG rules by IP/CIDR is brittle — add a VM, renumber a subnet, and your rules break. An ASG decouples what (role/application tier) from where (IP), so you write one rule (“allow 443 from WebServers to AppServers”) that keeps working as members change.
Key ideas
- An ASG contains NICs of VMs only (not subnets).
- NSG rules use an ASG as source or destination; you can mix IPs, service tags, and ASGs in rules.
- Membership is manual or via VM/VMSS; a NIC can be in one ASG; rules reference ASGs by name.
- A single ASG can appear in rules of one (or more) NSGs, and multiple ASGs can be combined.
Rule example
priority 100 source: Source=ASG WebServers dest=ASG AppServers allow TCP 443
priority 200 source: Source=ASG AppServers dest=ASG AppServers deny all (isolate tier)How it fits
NICs tagged into Web and DB ASGs; an NSG associated with the subnet references them:
Diagrams courtesy of Microsoft Learn / Azure docs: virtual-network/application-security-groups
Exam notes
- ASG = NIC membership by role; not an NSG replacement — it’s the object NSG rules reference.
- NSG’s “source/destination” can be an ASG, a service tag, or an IP/CIDR.
- Grouping by application tier is the canonical use case; rules become portable across IP changes.
Related
📘 Source: Microsoft Learn — Asg