I'm looking to create a Network Security Group (NSG) in Azure and attach it to an existing subnet using an ARM Template. I've already come across this site: https://github.com/Azure/azure-quickstart-templates/tree/master/201-nsg-add-to-existing-subnet but the template references additional files on GitHub which my client won't allow.

Ideally i'd like to avoid nested ARM Templates if possible and just use x1 template.json and x1 parameters.json file OR just x1 template.json file altogether.

If somebody has experience with this or knows of a good site to reference I would appreciate the help.

1 Answer 1


The example is doing this as a nested template because the resource group that the virtual network is in, is in a different resource group to the virtual network its self. If yor NSG and vNet are in the same resource group then there is no need for this. All you need to do is add the subnet part to your main template, with a dependency on your NSG.

      "apiVersion": "2018-03-01",
      "type": "Microsoft.Network/virtualNetworks/subnets",
      "dependsOn": [
      "name": "[concat(parameters('virtualNetworkName'), '/', parameters('subnetName'))]",
      "location": "[resourceGroup().location]",
      "properties": {
        "addressPrefix": "[parameters('subnetAddressPrefix')]",
        "networkSecurityGroup": {
          "id": "[resourceId('Microsoft.Network/networkSecurityGroups', 'new-nsg')]"

If your NSG and vNet are in different resource groups then the only way to do this is with a nested template. This is one of the downsides or ARM compared to something like Terraform. That said there are still a couple of options you could look at:

  1. You could use an inline nested template. These are a bit limited but wouldn’t require you to reference an external file
  2. You could run it as two separate deployments, passing the NSG resource group between the two
  • Thank you for the explanation, that helped me a lot. Unfortunately, the NSG and VNet I'm working with have to be in separate RG's.
    – jrd1989
    Dec 15, 2019 at 21:28
  • @jrd1989 ok, I’ve added some more options that might help in this scenario
    – Sam Cogan
    Dec 15, 2019 at 22:24
  • After your explanation and reviewing the example in the link I provided initially I was able to get it figured out. Instead of github I used a storage account in our environment and an SAS token. I appreciate the help and support you provided, much appreciated!
    – jrd1989
    Dec 15, 2019 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.