Using Azure DevOps to track changes to Network Security Groups in Azure

I wanted an easy way to keep track of changes made to our NSGs in Azure and through a combination of a few offerings in Azure I settled on what I feel is a pretty good solution. The runbook is on a schedule to run every day and performs the following:
  1. Get the current configuration of the Network Security Group (NSG)
  2. Push the current configuration of the NSG to a DevOps repository
  3. Compare the current configuration against the previous configuration
  4. If there are any changes, send an email

Resources needed:
Azure Automation Runbook
Azure DevOps license (Basic Plan for access to use Repos)
Powershell
Azure Keyvault (for storing the DevOps API key)

Runbook code:

Comments

  1. the beJune 3, 2026 at 11:18 PM

    Using Azure DevOps to track changes to Network Security Groups (NSGs) in Azure helps organizations manage network security configurations in a controlled and auditable manner. Network Security Groups are used to define inbound and outbound traffic rules for Azure resources. By storing NSG configurations as Infrastructure as Code (IaC) in Azure DevOps repositories, teams can track every modification, review changes through pull requests, and maintain version history. This approach improves visibility, accountability, and consistency in network security management.

    ReplyDelete
  2. the beJune 3, 2026 at 11:19 PM

    Azure DevOps also supports automated deployment pipelines that can validate and apply NSG updates securely. Organizations can use continuous integration and continuous deployment (CI/CD) practices to test configuration changes before implementing them in production environments. Network Security Projects for Final Year.Additionally, audit logs, approvals, and change tracking features help security teams monitor who made changes and when they occurred. By integrating Azure DevOps with Azure network security management, organizations can strengthen governance, reduce configuration errors, and improve overall cloud security.

    ReplyDelete

Post a Comment

Popular posts from this blog

Auto-installing extensions on Firefox using Intune

Image
To build onto my previous blog post concerning ADMX ingestion in Intune to configure Mozilla Firefox settings I'm going to show you how to auto-install extensions in Firefox with Intune. In this example I'm using the uBlock Origin extension as an example. First you'll need to get the URL of the extension. This is different from Chrome where you just need to get the ID of the extension. The easiest way I found to do this is to open Firefox and go to the Extensions Page  at Mozilla and locate the extensions you want to install. Then right-click and copy the link to the "Add to Firefox" button on the extension page. Save the link for later. Now go to the Custom OMA-URI Settings profile in Intune and add a new row. Configure the fields as follows: Name : Extensions_Install OMA-URI (case sensitive):  ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install Data type (String value)*: <enabled/> <data id="...
Read more

Disable DNS over HTTPS in Firefox using Intune

Image
Mozilla makes available admx files (Group Policy settings) which allow you to configure some settings in Firefox using Group Policy.  I'm trying to move away from using Group Policy to manage our endpoints since it requires connectivity to a Domain Controller which in turn depends on a VPN connection for remote computers. Too many dependencies there for my taste and Intune makes it much easier to push out changes with the push of a button. This week I've been trying to use a custom configuration profile in Intune to disable DNS over HTTPS on our Windows endpoints. Some of our IPS functionality uses DNS requests to block access to certain websites and DNS over HTTPS makes it easy to bypass that method of content blocking. Intune offers something they call "ADMX ingestion" which sounds weird and biological but basically it just lets you apply Group Policy like functionality using Intune. Making changes to Chrome was easy using this method because Google has a...
Read more

How to find the OMA-URI from ingested ADMX files

Image
There's a great  article  explaining how to ingest third party ADMX files into Intune and then configure policy using Intune per the settings in the ADMX file. I had trouble piecing together the OMA-URI using the steps in the article so I'm writing to explain a method I found which I feel is much easier to determine the OMA-URI. After ingesting the ADMX file into Intune assign the profile to a test device and then using Regedit browse to the following location: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxDefault That will list all of the settings along with the OMA-URI paths to include in your Intune profile for the Custom OMA-URI Settings. Just be sure to replace the backslash in the registry path with a forward slash as shown below:
Read more