services / Azure / Network Watcher security group view

Returns both the configured and effective network security group rules applied to a target VM's network interfaces, merging NIC-, subnet-, and default-level rules into the rule set actually enforced.

Read-only, but exposes the effective (post-merge) firewall posture of a VM without requiring direct read access to every NSG in the chain, making it a higher-value reconnaissance primitive than listing NSGs individually.

Microsoft.​Network/​networkWatchers/​securityGroupView/​action

Lets an attacker map exactly which inbound/outbound traffic is actually allowed to/from a VM, identifying reachable ports and segmentation gaps to focus follow-on network attacks, without needing to install or run any scanning tooling.

Risks

1. Network discovery (LOW)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links