Azure Compliance ControlsAzure Virtual Network
Network security groups should have Diagnostic Settings configured
This policy automatically deploys diagnostic settings to network security groups. A storage account with name '{storagePrefixParameter}{NSGLocation}' will be automatically created. The powerpipe check is titled Deploy Diagnostic Settings for Network Security Groups.
What this control checks
Network security groups have diagnostic settings deployed automatically
Framework mappings
The clauses this control is mapped to in each framework.
- 0860.09m1Organizational.9-09.m 09.06 Network Security Management
Related controls
- Regions with newly created virtual networks should have Network Watcher deployed
- Network security groups should have flow logs captured and sent to Log Analytics
- Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
- Azure Monitor should have activity log collection enabled for all regions
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_diagnostic_setting_deployed - Powerpipe Control:
azure_compliance.control.network_security_group_diagnostic_setting_deployed
Last reviewed: 2026-10-13