title: Azure Network Security Groups not working? (attached to subnet)
body: <p>I am trying to secure some subnets in a virtual network.</p>
  
  <p>I have Virtual Network 1 with Subnets A, B, C.</p>
  
  <p>I have a VM in each subnet with default endpoints (RDP and WinRM). </p>
  
  <p>I used the following commands to create and attach the Network Security Group to subnet C:</p>
  
  <pre><code>$SGName = 'SecurityGroupC'
  $location = 'West US'
  $virtualNetwork = '1'
  $subnet = 'C'
  
  New-AzureNetworkSecurityGroup -Name $SGName -Location $Location -Label $SGName
  
  Get-AzureNetworkSecurityGroup -Name $SGName | Set-AzureNetworkSecurityGroupToSubnet -VirtualNetworkName $VirtualNetwork -SubnetName $Subnet
  </code></pre>
  
  <p>I can see the default rules by running:</p>
  
  <pre><code>Get-AzureNetworkSecurityGroup -Name $SGName -Detailed
  </code></pre>
  
  <p>Which shows the expected default rules:</p>
  
  <pre><code>Name  : SecurityGroupC
  Rules : 
  
         Type: Inbound
  
      Name                 Priority  Action   Source Address  Source Port   Destination      Destination    Protocol
                                              Prefix          Range         Address Prefix   Port Range             
      ----                 --------  ------   --------------- ------------- ---------------- -------------- --------
      ALLOW VNET INBOUND   65000     Allow    VIRTUAL_NETWORK *             VIRTUAL_NETWORK  *              *       
      ALLOW AZURE LOAD     65001     Allow    AZURE_LOADBALAN *             *                *              *       
      BALANCER INBOUND                        CER                                                                   
      DENY ALL INBOUND     65500     Deny     *               *             *                *              *       
  
  
         Type: Outbound
  
      Name                 Priority  Action   Source Address  Source Port   Destination      Destination    Protocol
                                              Prefix          Range         Address Prefix   Port Range             
      ----                 --------  ------   --------------- ------------- ---------------- -------------- --------
      ALLOW VNET OUTBOUND  65000     Allow    VIRTUAL_NETWORK *             VIRTUAL_NETWORK  *              *       
      ALLOW INTERNET       65001     Allow    *               *             INTERNET         *              *       
      OUTBOUND                                                                                                      
      DENY ALL OUTBOUND    65500     Deny     *               *             *                *              *       
  </code></pre>
  
  <p>Based on these rules my RDP endpoint on my VM in subnet C should stop working. However I am still able to RDP directly to my VM from the internet. Is there something I am missing?</p>