Network security & firewalls
Network ACLs vs Network security groups and application security groups / Azure Virtual Network Manager
Azure has no stateless network ACL.
The closest option is an NSG associated with the subnet, which is stateful and supports deny rules. Virtual Network Manager security admin rules can enforce organization-wide rules that override NSGs.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | Network ACLs | Network security groups and application security groups Azure Virtual Network Manager |
| Lifecycle | Generally available | Generally available Generally available |
| What it is | Stateless, numbered allow and deny rules applied at the subnet boundary, evaluated in order for inbound and outbound traffic. | Stateful, prioritized allow and deny rules applied to subnets or network interfaces. Application security groups let rules target groups of VMs instead of IP ranges. Centrally groups virtual networks across subscriptions and regions to deploy connectivity (mesh or hub-and-spoke), security admin rules, routing, and IP address management (IPAM) pools. |
| Pricing model | Free. | NSGs are free. Virtual Network Manager is billed separately. |
| Docs | Network ACLs docs | Network security groups and application security groups docs Azure Virtual Network Manager docs |
| Pricing page | Network ACLs pricing | Network security groups and application security groups pricing Azure Virtual Network Manager pricing |
| Exams | SAA-C03 ANS-C01 Retiring | AZ-700 |
Key differences
- Statefulness. Network ACLs are stateless, so return traffic needs its own rule (including ephemeral ports). NSGs are stateful.
- Central rules. Virtual Network Manager security admin rules apply across many virtual networks and are evaluated before NSGs, which is useful for guardrails like blocking high-risk ports.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Free. Network ACLs pricing →
- Azure
- NSGs are free. Virtual Network Manager is billed separately. Network security groups and application security groups pricing → Azure Virtual Network Manager pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of Network ACLs?
Azure has no stateless network ACL. The closest option is an NSG associated with the subnet, which is stateful and supports deny rules. Virtual Network Manager security admin rules can enforce organization-wide rules that override NSGs.
How does pricing compare between Network ACLs and Network security groups and application security groups and Azure Virtual Network Manager?
AWS: Free. Azure: NSGs are free. Virtual Network Manager is billed separately. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; Microsoft Certified – Azure Network Engineer Associate (AZ-700).