A Network Security Group (NSG) is a firewall for your VM's network traffic — and locking one down properly is one of the highest-value security steps you can take in Azure.

Steps

1. In the Azure portal, go to your VM, then click Networking in the left-hand menu.
2. Review the Inbound port rules — look specifically for rules allowing RDP (port 3389) or SSH (port 22) from Any source, which is a common and risky default from quick-create wizards.
3. Click Add inbound port rule, and for the source, choose IP Addresses and enter your office's public IP range instead of Any.
4. Delete or disable the old, overly permissive rule once the new restricted rule is confirmed working.
5. For remote access without opening RDP/SSH to the internet at all, consider Azure Bastion, which provides secure browser-based access to your VM without exposing those ports publicly.

Common Questions

How do I find my office's public IP to allow?

From a device on your office network, search "what is my IP" in a browser — that's the address to allow. Note that if your ISP doesn't provide a static IP, this address can change over time and may need periodic updates.

What's the difference between an NSG and Azure Firewall?

An NSG is a basic, free packet filter attached to a VM or subnet — good for straightforward inbound/outbound rules. Azure Firewall is a separate, more advanced managed service for centralized, organization-wide traffic filtering and logging across multiple resources.