Gateway subnets should not have a network security group configured
Gateway subnets should not be configured with a network security group. The Azure Policy definition denies a gateway subnet configured with a network security group. Assigning a network security group to a gateway subnet will cause the gateway to stop functioning.
Assigning a network security group to a gateway subnet will cause the gateway to stop functioning.
What this control checks
A subnet named GatewaySubnet fails if a network security group is configured on it.
Common pitfalls
NSG on gateway subnet stops the gateway
Assigning a network security group to a gateway subnet will cause the gateway to stop functioning.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Gateway subnets should not be configured with a network security group" (35f9c03a-cc27-418e-9c0c-539ff999d010); PowerPipe control azure_compliance.control.network_security_group_not_configured_gateway_subnets.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0805.01m1Organizational.12-01.m (01.04 Network Access Control), 0806.01m2Organizational.12356-01.m (01.04 Network Access Control) and 0894.01m2Organizational.7-01.m (01.04 Network Access Control).
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_not_configured_gateway_subnets - Powerpipe Control:
azure_compliance.control.network_security_group_not_configured_gateway_subnets - Azure Policy Definition:
35f9c03a-cc27-418e-9c0c-539ff999d010
Last reviewed: 2026-10-13