Network security groups should have Diagnostic Settings configured
This policy automatically deploys diagnostic settings to network security groups. A storage account with name '{storagePrefixParameter}{NSGLocation}' will be automatically created. The powerpipe check is titled Deploy Diagnostic Settings for Network Security Groups.
What this control checks
Network security groups have diagnostic settings deployed automatically
Common pitfalls
A storage account is created automatically
A storage account with name {storagePrefixParameter}{NSGLocation} will be automatically created.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.network_security_group_diagnostic_setting_deployed.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-03 (Representations of the organization's authorized network communication and internal and external network data flows are...).
Framework mappings
The clauses this control is mapped to in each framework.
- 0860.09m1Organizational.9-09.m 09.06 Network Security Management
Related controls
- Regions with newly created virtual networks should have Network Watcher deployed
- Network security groups should have flow logs captured and sent to Log Analytics
- Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
- Azure Monitor should have activity log collection enabled for all regions
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_diagnostic_setting_deployed - Powerpipe Control:
azure_compliance.control.network_security_group_diagnostic_setting_deployed
Last reviewed: 2026-10-13