services / Azure / Application security group

An Application Security Group (ASG) is a logical grouping of network interfaces (by application role) that can be referenced as the source/destination of NSG rules, instead of explicit IP ranges, to scope firewall rules to a set of VMs.

An ASG is a perimeter/segmentation control referenced by NSG rules; membership in one determines which firewall rules apply to a given interface, so misuse indirectly controls network access the same way an NSG does. Rated consistent with the other network-segmentation resources documented alongside it.

Microsoft.​Network/​applicationSecurityGroups/​delete

Deleting an ASG invalidates any NSG rule that references it as a source/destination, silently disabling those rules (opening the traffic they were meant to restrict) or breaking rules that were permitting required traffic.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links