Guidance needed to comply with Defender network security group flow log policy.

Question

Guidance needed to comply with Defender network security group flow log policy.

Ashutosh Jadhav 5

I am working on implementing the Azure Defender compliance policy: “Flow logs should be configured for every network security group.”

This policy requires enabling flow logs for all Network Security Groups (NSGs). However, I am facing an issue where the option to select Flow log type: Network security group is disabled by default, as indicated by the notification provided in the Azure portal.

How can I achieve compliance with this policy? We need to meet this requirement as part of our Azure SOC 2 2023 compliance efforts.

User's image

Thanks,

Ashutosh

Shree Hima Bindu Maganti 7,590 Reputation points Microsoft External Staff Moderator

2025-10-20T16:15:45.39+00:00

Hi @Ashutosh Jadhav
It looks like you're working toward compliance with the Azure Defender policy for NSG flow logs, but the flow log option is currently disabled.

Make sure the Microsoft.Insights resource provider is registered in your subscription. If it’s not, register it by following the instructions here.

Use Azure Policy to set up NSG flow logs:

Sign in to the Azure portal and search for Policy.

Go to Assignments and select Assign policy.

Choose the correct Scope (subscription or resource group).

Under Policy definition, search for "flow log" and pick the policy named Flow logs should be configured for every network security group.

After assigning the policy, check the Compliance section to see if your NSGs are compliant. It may take a few minutes for the policy to evaluate and apply the flow logs.

Ensure the storage account for flow logs is in the same region as your NSG. If storage access keys have changed, try disabling and re-enabling flow logs.

Flow logs may not work if there are network issues or if VMs are inactive. Make sure VMs are running and check for any blockers, such as App Gateways or firewalls.

For more details on managing NSG flow logs with Azure Policy, official documentation.
Let me know if you have any further assistances needed.
Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2025-10-21T06:13:38.9166667+00:00

Hi @Ashutosh Jadhav,

As per the official Azure documentation, Network Security Group (NSG) flow logs are being retired, you won’t be able to create new NSG flow logs after June 30, 2025, and existing ones will be retired by September 30, 2027. You’re advised to migrate to Virtual Network Flow Logs, which are the replacement and address the limitations of NSG flow logs.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-migrate

Please go ahead and create Virtual Network Flow Logs to stay compliant with the latest standards. If you still face issues regarding the Defender compliance policy after this change, kindly let us know we’ll check further with the compliance team.

Thanks,

Thanmayi
Ashutosh Jadhav 5 Reputation points

2025-10-21T09:07:12.2966667+00:00

Hi @Thanmayi Godithi
Thanks for the reply. I have already created the Virtual Network Flow Logs for all of the Vnets but it still shows non compliance for “Flow logs should be configured for every network security group” policy. How can I exempt or get compliant with this policy.**
**
Thanks**,**

Ashutosh
Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2025-10-23T02:18:36.94+00:00

Hi @Ashutosh Jadhav,

Thank you for sharing the details. Could you please share the below details via "Private message" option.

Email ID:

Time zone:

Subscription ID:

Tenand ID:

Thanks
Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2025-10-27T08:52:53.11+00:00

Hi @Ashutosh Jadhav,

We checked with our Product Group team and below is the update from their end:

PG team has added the NSG flow log’s policy deprecation to their backlog and will be removing it soon to ensure customers do not receive compliance alerts.

NSG flow logs are being replaced with VNet flow logs, and customers can use these wherever they were previously using NSG flow logs.

Additionally, they have worked on creating another policy for VNet flow logs similar to NSG flow logs, so customers can use that in the interim. Ref - https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-policy

Please note that the product group has already initiated work on disabling the NSG flow log policy. The changes are expected to be implemented within 2–3 weeks. In the meantime, we recommend migrating to VNet flow logs and allowing this window for the NSG flow log policy to be fully removed.

Also, please try deleting the assigned policy which you have assigned to your subscription now and that compliance issue will be gone.

Kindly let us know if the above helps or you need further assistance on this issue.

Your answer

Shree Hima Bindu Maganti 7,590 Reputation points Microsoft External Staff Moderator

2025-10-20T16:15:45.39+00:00

Hi @Ashutosh Jadhav
It looks like you're working toward compliance with the Azure Defender policy for NSG flow logs, but the flow log option is currently disabled.

Make sure the Microsoft.Insights resource provider is registered in your subscription. If it’s not, register it by following the instructions here.

Use Azure Policy to set up NSG flow logs:

Sign in to the Azure portal and search for Policy.

Go to Assignments and select Assign policy.

Choose the correct Scope (subscription or resource group).

Under Policy definition, search for "flow log" and pick the policy named Flow logs should be configured for every network security group.

After assigning the policy, check the Compliance section to see if your NSGs are compliant. It may take a few minutes for the policy to evaluate and apply the flow logs.

Ensure the storage account for flow logs is in the same region as your NSG. If storage access keys have changed, try disabling and re-enabling flow logs.

Flow logs may not work if there are network issues or if VMs are inactive. Make sure VMs are running and check for any blockers, such as App Gateways or firewalls.

For more details on managing NSG flow logs with Azure Policy, official documentation.
Let me know if you have any further assistances needed.
Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2025-10-21T06:13:38.9166667+00:00

Hi @Ashutosh Jadhav,

As per the official Azure documentation, Network Security Group (NSG) flow logs are being retired, you won’t be able to create new NSG flow logs after June 30, 2025, and existing ones will be retired by September 30, 2027. You’re advised to migrate to Virtual Network Flow Logs, which are the replacement and address the limitations of NSG flow logs.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-migrate

Please go ahead and create Virtual Network Flow Logs to stay compliant with the latest standards. If you still face issues regarding the Defender compliance policy after this change, kindly let us know we’ll check further with the compliance team.

Thanks,

Thanmayi
Ashutosh Jadhav 5 Reputation points

2025-10-21T09:07:12.2966667+00:00

Hi @Thanmayi Godithi
Thanks for the reply. I have already created the Virtual Network Flow Logs for all of the Vnets but it still shows non compliance for “Flow logs should be configured for every network security group” policy. How can I exempt or get compliant with this policy.**
**
Thanks**,**

Ashutosh
Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2025-10-23T02:18:36.94+00:00

Hi @Ashutosh Jadhav,

Thank you for sharing the details. Could you please share the below details via "Private message" option.

Email ID:

Time zone:

Subscription ID:

Tenand ID:

Thanks
Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2025-10-27T08:52:53.11+00:00

Hi @Ashutosh Jadhav,

We checked with our Product Group team and below is the update from their end:

PG team has added the NSG flow log’s policy deprecation to their backlog and will be removing it soon to ensure customers do not receive compliance alerts.

NSG flow logs are being replaced with VNet flow logs, and customers can use these wherever they were previously using NSG flow logs.

Additionally, they have worked on creating another policy for VNet flow logs similar to NSG flow logs, so customers can use that in the interim. Ref - https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-policy

Please note that the product group has already initiated work on disabling the NSG flow log policy. The changes are expected to be implemented within 2–3 weeks. In the meantime, we recommend migrating to VNet flow logs and allowing this window for the NSG flow log policy to be fully removed.

Also, please try deleting the assigned policy which you have assigned to your subscription now and that compliance issue will be gone.

Kindly let us know if the above helps or you need further assistance on this issue.