Guidance needed to comply with Defender network security group flow log policy.

Question

Guidance needed to comply with Defender network security group flow log policy.

Ashutosh Jadhav 0

I am working on implementing the Azure Defender compliance policy: “Flow logs should be configured for every network security group.”

This policy requires enabling flow logs for all Network Security Groups (NSGs). However, I am facing an issue where the option to select Flow log type: Network security group is disabled by default, as indicated by the notification provided in the Azure portal.

How can I achieve compliance with this policy? We need to meet this requirement as part of our Azure SOC 2 2023 compliance efforts.

User's image

Thanks,

Ashutosh

Shree Hima Bindu Maganti 5,805 Reputation points Microsoft External Staff Moderator

2025-10-20T16:15:45.39+00:00

Hi @Ashutosh Jadhav
It looks like you're working toward compliance with the Azure Defender policy for NSG flow logs, but the flow log option is currently disabled.

Make sure the Microsoft.Insights resource provider is registered in your subscription. If it’s not, register it by following the instructions here.

Use Azure Policy to set up NSG flow logs:

Sign in to the Azure portal and search for Policy.

Go to Assignments and select Assign policy.

Choose the correct Scope (subscription or resource group).

Under Policy definition, search for "flow log" and pick the policy named Flow logs should be configured for every network security group.

After assigning the policy, check the Compliance section to see if your NSGs are compliant. It may take a few minutes for the policy to evaluate and apply the flow logs.

Ensure the storage account for flow logs is in the same region as your NSG. If storage access keys have changed, try disabling and re-enabling flow logs.

Flow logs may not work if there are network issues or if VMs are inactive. Make sure VMs are running and check for any blockers, such as App Gateways or firewalls.

For more details on managing NSG flow logs with Azure Policy, official documentation.
Let me know if you have any further assistances needed.
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-10-21T06:13:38.9166667+00:00

Hi @Ashutosh Jadhav,

As per the official Azure documentation, Network Security Group (NSG) flow logs are being retired, you won’t be able to create new NSG flow logs after June 30, 2025, and existing ones will be retired by September 30, 2027. You’re advised to migrate to Virtual Network Flow Logs, which are the replacement and address the limitations of NSG flow logs.

Reference: https://free.blessedness.top/en-us/azure/network-watcher/nsg-flow-logs-migrate

Please go ahead and create Virtual Network Flow Logs to stay compliant with the latest standards. If you still face issues regarding the Defender compliance policy after this change, kindly let us know we’ll check further with the compliance team.

Thanks,

Thanmayi
Ashutosh Jadhav 0 Reputation points

2025-10-21T09:07:12.2966667+00:00

Hi @Thanmayi Godithi
Thanks for the reply. I have already created the Virtual Network Flow Logs for all of the Vnets but it still shows non compliance for “Flow logs should be configured for every network security group” policy. How can I exempt or get compliant with this policy.**
**
Thanks**,**

Ashutosh
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-10-23T02:18:36.94+00:00

Hi @Ashutosh Jadhav,

Thank you for sharing the details. Could you please share the below details via "Private message" option.

Email ID:

Time zone:

Subscription ID:

Tenand ID:

Thanks

Your answer

Shree Hima Bindu Maganti 5,805 Reputation points Microsoft External Staff Moderator

2025-10-20T16:15:45.39+00:00

Hi @Ashutosh Jadhav
It looks like you're working toward compliance with the Azure Defender policy for NSG flow logs, but the flow log option is currently disabled.

Make sure the Microsoft.Insights resource provider is registered in your subscription. If it’s not, register it by following the instructions here.

Use Azure Policy to set up NSG flow logs:

Sign in to the Azure portal and search for Policy.

Go to Assignments and select Assign policy.

Choose the correct Scope (subscription or resource group).

Under Policy definition, search for "flow log" and pick the policy named Flow logs should be configured for every network security group.

After assigning the policy, check the Compliance section to see if your NSGs are compliant. It may take a few minutes for the policy to evaluate and apply the flow logs.

Ensure the storage account for flow logs is in the same region as your NSG. If storage access keys have changed, try disabling and re-enabling flow logs.

Flow logs may not work if there are network issues or if VMs are inactive. Make sure VMs are running and check for any blockers, such as App Gateways or firewalls.

For more details on managing NSG flow logs with Azure Policy, official documentation.
Let me know if you have any further assistances needed.
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-10-21T06:13:38.9166667+00:00

Hi @Ashutosh Jadhav,

As per the official Azure documentation, Network Security Group (NSG) flow logs are being retired, you won’t be able to create new NSG flow logs after June 30, 2025, and existing ones will be retired by September 30, 2027. You’re advised to migrate to Virtual Network Flow Logs, which are the replacement and address the limitations of NSG flow logs.

Reference: https://free.blessedness.top/en-us/azure/network-watcher/nsg-flow-logs-migrate

Please go ahead and create Virtual Network Flow Logs to stay compliant with the latest standards. If you still face issues regarding the Defender compliance policy after this change, kindly let us know we’ll check further with the compliance team.

Thanks,

Thanmayi
Ashutosh Jadhav 0 Reputation points

2025-10-21T09:07:12.2966667+00:00

Hi @Thanmayi Godithi
Thanks for the reply. I have already created the Virtual Network Flow Logs for all of the Vnets but it still shows non compliance for “Flow logs should be configured for every network security group” policy. How can I exempt or get compliant with this policy.**
**
Thanks**,**

Ashutosh
Thanmayi Godithi 1,635 Reputation points Microsoft External Staff Moderator

2025-10-23T02:18:36.94+00:00

Hi @Ashutosh Jadhav,

Thank you for sharing the details. Could you please share the below details via "Private message" option.

Email ID:

Time zone:

Subscription ID:

Tenand ID:

Thanks

Share via

Guidance needed to comply with Defender network security group flow log policy.

Your answer