Ensure that outbound traffic is restricted to only that which is necessary, and all other traffic denied

Network Security groups provide stateful filtering of ingress/egress network traffic to Azure resources. It is recommended that no security group allows unrestricted egress access

Risk Level: High
Cloud Entity: Network security group
CloudGuard Rule ID: D9.AZU.NET.22
Covered by Spectral: Yes
Category: Networking & Content Delivery


NetworkSecurityGroup should not have outboundSecurityRules contain [ protocol = 'All' and destinationAddressPrefixes contain [ '' ] and action='ALLOW']


Azure Console:

  1. Navigate to the 'All services'
  2. Navigate to the Networking, and select 'Network security groups'
  3. Select the Network security group to be modified
  4. Under Settings, select 'Outbound security rules'
  5. Select the rule to be modified and edit it to allow only specific IP addresses or protocols

Network security group

You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

Compliance Frameworks

  • AZU PCI-DSS 4.0
  • Azure CloudGuard Best Practices
  • Azure CloudGuard CheckUp
  • Azure HITRUST v9.5.0
  • Azure NIST 800-53 Rev 5
  • CloudGuard Azure All Rules Ruleset