Security group
Why this term needs disambiguation
“Security group” is not one Azure object. It can refer to an identity membership boundary, an Azure DevOps permission group, or an application-oriented network grouping. Choosing the wrong one produces a category error: identity groups do not filter packets, and network groups do not grant repository permissions.
Three meanings
- Microsoft Entra security group — groups users, devices, or service principals for identity administration, licensing, Conditional Access targeting, or Azure RBAC assignment. See groups.
- Azure DevOps security group — groups users/service identities for organization, project, repository, pipeline, or board permissions. It is governed by Azure DevOps permissions, not Azure RBAC. See azure-devops-security-groups.
- Azure Application Security Group (ASG) — groups NICs by application role so NSG rules can reference roles rather than IP addresses. It does not authorize sign-in. See asg.
Decision rule
If the requirement says who may sign in or administer, begin with Entra or Azure DevOps groups. If it says which VM tier may send packets to another tier, begin with an ASG and NSG.
Related
groups · asg · nsg · rbac · azure-devops-security-groups · azure-devops-access-levels