Search code examples
azureazure-virtual-networkprivate-subnet

Microsoft Defender for Cloud: "Subnets should be associated with a network security group" status is Not Applicable for a private endpoints subnet

I have a subnet dedicated to private endpoints and I don't have NSG associated with this subnet.

Microsoft Defender for Cloud shows that

"Subnets should be associated with a network security group" status is Not Applicable

for the above mentioned private endpoints subnet

Solution

  • Microsoft Defender for Cloud is flagging "Subnets should be associated with a network security group status is Not Applicable" this issue may occur if you don't have subnet associated with NSG as low severity.

    As, Microsoft Defender is part of Azure Security Centre, If you do not assign NSG to a VM, By default all the ports in Azure VM's are opened and exposed, thus it's not a good security practice, when you have private endpoint enabled for a subnet but not an NSG.

    enter image description here

    To resolve this issue, check the below:

    Usually while deploying services, it automatically associates with NSG. If not in your virtual network -> Subnet -> Add NSG like below

    enter image description here

    It will associate subnet with NSG, if you don't have NSG try to create separate NSG and associate like below:

    enter image description here

    I agree with Roderick Bant If the security recommendations in Microsoft Defender for Cloud shows a scope which you feel it doesn't belong and if it is inappropriate for a particular subscription then use Exempt.

    enter image description here

    If you have private endpoint enable for other services than VM you can exempt this policy

    If still the issue occurs, make sure your network security group and virtual network security rules are set up correctly for your private endpoint subnet. Also check whether the association between your subnet and network security group is configured correctly.