Network security groups and application security groups, service tags, rule priority and default rules

A network security group (NSG) is a stateful packet filter for Azure virtual networks. It holds inbound and outbound security rules and can be associated with a subnet, a network interface (NIC) or both. Stateful means return traffic for an allowed connection is automatically permitted, so you only write a rule for the direction the connection starts in.