I have made some virtual machines in Azure.
I can see that a vnet has been created for my VMs. This is great as they need a network and I would (of course) like them to be able to connect to each other.
I can also see that a network security group has been created, which is great as I can then control firewall rules and external access.
However, I'm not clear on the difference and why they both exist? Why are they separate, as opposed to the network security group being implemented as a firewall tab under the vnet (in the way that SQL database does). I also cannot see how the vnet and network security group are related. They both have the same NICs, but dont appear to have any awareness of each other - does this mean it's possible for the security group to not apply to some NICs on the network? (and vice versa, can a network security group have NICs from different vnets?).