Question 103778 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – Microsoft Defender for Cloud: "Subnets should be associated with a network security group" status is Not Applicable for a private endpoints subnet

I have a subnet dedicated to private endpoints and I don’t have NSG associated with this subnet.

Microsoft Defender for Cloud shows that

"Subnets should be associated with a network security group" status is Not Applicable

for the above mentioned private endpoints subnet

Tags:

2

Answers


  1. 0

    You can create exemptions for rules on specific resources if there are reasons the rule should not apply to a given resource.

    To create an exemtion for a recommendation open it’s details page. Then click exempt on the top toolbar. Select a scope, category and enter a name for the exemption and click create.

    See the docs for details.

    Login or Signup to reply.
  2. 0

    Microsoft Defender for Cloud is flagging "Subnets should be associated with a network security group status is Not Applicable" this issue may occur if you don’t have subnet associated with NSG as low severity.

    As, Microsoft Defender is part of Azure Security Centre, If you do not assign NSG to a VM, By default all the ports in Azure VM’s are opened and exposed, thus it’s not a good security practice, when you have private endpoint enabled for a subnet but not an NSG.

    enter image description here

    To resolve this issue, check the below:

    Usually while deploying services, it automatically associates with NSG. If not in your virtual network -> Subnet -> Add NSG like below

    enter image description here

    It will associate subnet with NSG, if you don’t have NSG try to create separate NSG and associate like below:

    enter image description here

    I agree with Roderick Bant If the security recommendations in Microsoft Defender for Cloud shows a scope which you feel it doesn’t belong and if it is inappropriate for a particular subscription then use Exempt.

    enter image description here

    If you have private endpoint enable for other services than VM you can exempt this policy

    If still the issue occurs, make sure your network security group and virtual network security rules are set up correctly for your private endpoint subnet. Also check whether the association between your subnet and network security group is configured correctly.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search