Network Security Group (NSG)
An NSG's rule set is control-plane configuration, not a running instance — it's synchronously replicated across every zone in the region automatically, with nothing to configure or verify. Microsoft doesn't publish a dedicated SLA for it, the same way it doesn't for Virtual Network itself. Cross-region means an entirely separate NSG with its own rules, kept in sync by you.
Standard NSG (default)
Rules are enforced at every NIC or subnet they're attached to, replicated within the region by the Virtual Network platform — no configuration required or available.
- Replication
- Synchronous
- RPO
- 0
- RTO
- N/A — not a running instance that can fail
- Failover trigger
- Automatic
- Relative cost
- No extra cost
NSGs carry no direct charge regardless of rule count or complexity.
There is no lesser or non-replicated configuration to opt out of.
Can reach at most Risk, never Pass — failover is automatic, but the RPO/RTO figures aren't backed by a Microsoft SLA or explicit commitment.
Built-in intra-region zone replication
Because an NSG's rules live in the Virtual Network control plane, and a virtual network spans every Availability Zone in its region automatically, rule enforcement is unaffected by a single zone's failure — there's no separate zonal SKU or setting.
- Replication
- Synchronous
- RPO
- 0
- RTO
- N/A — the rule set itself has no zone-scoped failure mode; only the NIC/subnet it's attached to can be affected, and that's tracked under that resource
- Failover trigger
- Automatic
- Relative cost
- No extra cost
No separate charge — this is inherent VNet behavior, not a paid feature.
Can reach at most Risk, never Pass — failover is automatic, but the RPO/RTO figures aren't backed by a Microsoft SLA or explicit commitment.
No native feature — customer-managed second NSG
NSGs are region-scoped, tied to the virtual network they belong to. A second region means an independent NSG with its own rule set, typically kept consistent through IaC (Bicep/Terraform/ARM) rather than any platform replication.
- Replication
- N/A
- RPO
- Entirely dependent on your IaC/deployment pipeline keeping rule sets in sync
- RTO
- Entirely dependent on your process for deploying and validating the secondary region's rules
- Failover trigger
- N/A
- Relative cost
- No extra cost
The NSG resource itself is still free — the real cost of this option is the IaC pipeline maintaining two rule sets, not an Azure charge.
Shows Unknown at every tier — there's no fixed RPO/RTO for this option; it depends entirely on an architecture you'd have to design and build.
Gotchas
No SLA doesn't mean no reliability — it means no committed number
NSGs (and Virtual Network generally) have genuinely automatic, synchronous, zone-spanning behavior with no configuration needed — but because Microsoft publishes no percentage to hold them to, this tool scores it RISK rather than PASS even at the strictest tiers. That's a scoring conservatism, not a claim the mechanism is unreliable.
A correct NSG doesn't make the rest of the subnet resilient
Rule replication being automatic says nothing about the zone or region posture of the VMs, gateways, or other resources the NSG is attached to — each of those has its own, separate resiliency story that needs assessing on its own terms.
Multi-region rule drift is a real operational risk
Because regional NSGs are entirely independent, a manually-applied rule change in one region that isn't mirrored to the other is invisible until the secondary region is actually serving traffic — usually during the exact outage that triggered the failover.