Microsoft Defender for Cloud: "Subnets should be associated with a network security group"-CodePudding

I have a subnet dedicated to private endpoints and I don't have NSG associated with this subnet.

Microsoft Defender for Cloud shows that

"Subnets should be associated with a network security group" status is Not Applicable

for the above mentioned private endpoints subnet

CodePudding user response：

You can create exemptions for rules on specific resources if there are reasons the rule should not apply to a given resource.

To create an exemtion for a recommendation open it's details page. Then click exempt on the top toolbar. Select a scope, category and enter a name for the exemption and click create.

See

To resolve this issue, check the below:

Usually while deploying services, it automatically associates with NSG. If not in your virtual network -> Subnet -> Add NSG like below

enter image description here

It will associate subnet with NSG, if you don't have NSG try to create separate NSG and associate like below:

enter image description here

I agree with Roderick Bant If the security recommendations in Microsoft Defender for Cloud shows a scope which you feel it doesn't belong and if it is inappropriate for a particular subscription then use Exempt.

enter image description here

If you have private endpoint enable for other services than VM you can exempt this policy

If still the issue occurs, make sure your network security group and virtual network security rules are set up correctly for your private endpoint subnet. Also check whether the association between your subnet and network security group is configured correctly.