Difference between NSG’s (Network Security Group) & ASG’s (Application Security Group) Azure

Network Security Group is the Azure Resource that will use to enforce and control the network traffic with, whereas Application Security Group is an object reference within a Network Security Group.

Network Security Group

• A network security group is used to enforce and control network traffic.
• Controls the inbound and outbound traffic at the subnet level.
• Rules are applied to all resources in the associated subnet.
• Has separate rules for inbound and outbound traffic.
• NSG has a limit of 1000 rules.
• Supports ALLOW and DENY rules.
• Not allowed to specify multiple IP addresses and IP address ranges in the NSG created by the classic deployment model.

Application Security Group

• An application security group is an object reference within an NSG.
• Controls the inbound and outbound traffic at the network interface level.
• Rules are applied to all ASGs in the same virtual network.
• Has separate rules for inbound and outbound traffic.
• ASGs that can be specified within all security rules of an NSG have a limit of 100 rules.
• Supports ALLOW and DENY rules.
• Not allowed to specify multiple ASGs in the source or destination.