{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/", "slug": "dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access", "url": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/" }, "title": "Inspect every evaluated security-rule layer before opening Bastion access", "summary": "Use NSG diagnostics to locate the rule that denies the tested connection rather than stopping at a subnet allow rule.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:18+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 235, "potentially_affected": "Azure VM connections evaluated by Network Watcher NSG diagnostics across network security groups and Virtual Network Manager rules.", "dse_recommendation": "Capture the evaluated layers and exact denying rule before proposing a narrowly scoped access change.", "primary_source": { "name": "Check Security Rules Using NSG Diagnostics - Azure Network Watcher | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Network Watcher NSG diagnostics evaluates whether traffic is permitted by the applied security rules, including network security groups and Virtual Network Manager. Microsoft’s Bastion example illustrates a connection allowed at the network-admin and subnet layers but denied by the VM’s NIC-level group.

\n

For that example, Microsoft’s correction is an appropriately higher-priority allow rule, or an edit to the denying rule. A smaller priority number represents higher priority in the documented NSG rule change. Microsoft Learn.

\n

Applicability

\n

Define the actual source, destination, protocol, port and direction for the failed connection. Treat the tutorial addresses and permissive test selections as examples, not a ready-made production access policy.

\n

DSE recommendation

\n

DSE recommends preserving the diagnostics result and identifying the rule owner before making a change. Review every evaluated layer and tie the proposed exception to the intended management source and service. Avoid adding broad allowances merely because the first visible subnet rule appears correct; document which specific denial the proposal addresses.

\n

Verification

\n

Rerun diagnostics for the same connection profile after an approved change and compare the matched rules. Test the intended Bastion connection itself, then check a representative source or port that should remain denied. Keep both the allowed and denied results with the final rule scope. Continue investigating other connection problems if rule evaluation permits the traffic but the session still fails.

\n

Official references

\n

Microsoft Learn: Check Security Rules Using NSG Diagnostics. Source retrieved September 9, 2026.

", "content_text": "Source facts\nNetwork Watcher NSG diagnostics evaluates whether traffic is permitted by the applied security rules, including network security groups and Virtual Network Manager. Microsoft’s Bastion example illustrates a connection allowed at the network-admin and subnet layers but denied by the VM’s NIC-level group.\nFor that example, Microsoft’s correction is an appropriately higher-priority allow rule, or an edit to the denying rule. A smaller priority number represents higher priority in the documented NSG rule change. Microsoft Learn.\nApplicability\nDefine the actual source, destination, protocol, port and direction for the failed connection. Treat the tutorial addresses and permissive test selections as examples, not a ready-made production access policy.\nDSE recommendation\nDSE recommends preserving the diagnostics result and identifying the rule owner before making a change. Review every evaluated layer and tie the proposed exception to the intended management source and service. Avoid adding broad allowances merely because the first visible subnet rule appears correct; document which specific denial the proposal addresses.\nVerification\nRerun diagnostics for the same connection profile after an approved change and compare the matched rules. Test the intended Bastion connection itself, then check a representative source or port that should remain denied. Keep both the allowed and denied results with the final rule scope. Continue investigating other connection problems if rule evaluation permits the traffic but the session still fails.\nOfficial references\nMicrosoft Learn: Check Security Rules Using NSG Diagnostics. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nNetwork Watcher NSG diagnostics evaluates whether traffic is permitted by the applied security rules, including network security groups and Virtual Network Manager. Microsoft’s Bastion example illustrates a connection allowed at the network-admin and subnet layers but denied by the VM’s NIC-level group.\n\nFor that example, Microsoft’s correction is an appropriately higher-priority allow rule, or an edit to the denying rule. A smaller priority number represents higher priority in the documented NSG rule change. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules).\n\n## Applicability\n\nDefine the actual source, destination, protocol, port and direction for the failed connection. Treat the tutorial addresses and permissive test selections as examples, not a ready-made production access policy.\n\n## DSE recommendation\n\nDSE recommends preserving the diagnostics result and identifying the rule owner before making a change. Review every evaluated layer and tie the proposed exception to the intended management source and service. Avoid adding broad allowances merely because the first visible subnet rule appears correct; document which specific denial the proposal addresses.\n\n## Verification\n\nRerun diagnostics for the same connection profile after an approved change and compare the matched rules. Test the intended Bastion connection itself, then check a representative source or port that should remain denied. Keep both the allowed and denied results with the final rule scope. Continue investigating other connection problems if rule evaluation permits the traffic but the session still fails.\n\n## Official references\n\n[Microsoft Learn: Check Security Rules Using NSG Diagnostics](https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/", "url": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Inspect every evaluated security-rule layer before opening Bastion access", "item": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/", "url": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/", "headline": "Inspect every evaluated security-rule layer before opening Bastion access", "description": "Use NSG diagnostics to locate the rule that denies the tested connection rather than stopping at a subnet allow rule.", "abstract": "Use NSG diagnostics to locate the rule that denies the tested connection rather than stopping at a subnet allow rule.", "articleBody": "Source facts\nNetwork Watcher NSG diagnostics evaluates whether traffic is permitted by the applied security rules, including network security groups and Virtual Network Manager. Microsoft’s Bastion example illustrates a connection allowed at the network-admin and subnet layers but denied by the VM’s NIC-level group.\nFor that example, Microsoft’s correction is an appropriately higher-priority allow rule, or an edit to the denying rule. A smaller priority number represents higher priority in the documented NSG rule change. Microsoft Learn.\nApplicability\nDefine the actual source, destination, protocol, port and direction for the failed connection. Treat the tutorial addresses and permissive test selections as examples, not a ready-made production access policy.\nDSE recommendation\nDSE recommends preserving the diagnostics result and identifying the rule owner before making a change. Review every evaluated layer and tie the proposed exception to the intended management source and service. Avoid adding broad allowances merely because the first visible subnet rule appears correct; document which specific denial the proposal addresses.\nVerification\nRerun diagnostics for the same connection profile after an approved change and compare the matched rules. Test the intended Bastion connection itself, then check a representative source or port that should remain denied. Keep both the allowed and denied results with the final rule scope. Continue investigating other connection problems if rule evaluation permits the traffic but the session still fails.\nOfficial references\nMicrosoft Learn: Check Security Rules Using NSG Diagnostics. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:18+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-218-inspect-every-evaluated-security-rule-layer-before-opening-bastion-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Inspect every evaluated security-rule layer before opening Bastion access" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 235, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Check Security Rules Using NSG Diagnostics - Azure Network Watcher | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules" } } ] } }