An NSG rule allowing 0.0.0.0/0 inbound exposes whatever is behind it to the entire internet

What it is

A Network Security Group with an inbound allow rule whose source is * / 0.0.0.0/0. Whatever port that rule covers, any host on the internet can reach it, not just your network. When the exposed port is a management or database port, the stakes jump an order of magnitude — that case has its own entry, AZF-0097.

Impact (security)

Whatever listens behind the rule is reachable from the entire internet

Basis: Azure behavior (authored assessment). Figures are estimates, not measurements.

Why it happens

Broad rules get added "temporarily" to unblock a connection, a quick RDP into a VM, a vendor that needs access, a demo, and then never get tightened. The NSG keeps working, so nothing prompts a cleanup.

It also happens through inheritance: a permissive rule on a subnet NSG silently applies to every VM placed in that subnet later, long after the original reason is forgotten.

What it costs / blast radius

This is a security blast radius, not a bill. An exposed port is found by automated internet-wide scanners within minutes and becomes a standing target for probing and known-exploit attempts against whatever service answers. When the exposed ports include management or database ports (RDP, SSH, SQL Server, and the like), the risk is materially worse than a broad rule on an ordinary application port; that case gets its own entry, AZF-0097. The blast radius is the VM and everything reachable from it, which on a flat network can be most of the environment.

See it

Footgun: a debug rule that allows any source to any port

{
  name: 'allow-all-in'                // added "temporarily" during debugging
  properties: {
    priority: 100
    direction: 'Inbound'
    access: 'Allow'
    protocol: '*'
    sourceAddressPrefix: '*'          // anyone, anywhere
    destinationPortRange: '*'         // every port on the VM
  }
}

Fix: allow only the port the workload serves, from only where it's served

{
  name: 'allow-https-in'
  properties: {
    priority: 100
    direction: 'Inbound'
    access: 'Allow'
    protocol: 'Tcp'
    sourceAddressPrefix: 'AzureFrontDoor.Backend'  // or your LB / corp range
    destinationPortRange: '443'                    // just the app port
  }
}
// Management access (RDP/SSH) shouldn't ride an inbound allow at all —
// use Bastion or just-in-time access. See AZF-0097.

How StratoLens helps

StratoLens evaluates NSG rules across every subscription and flags inbound allows from 0.0.0.0/0, and because it tracks change history, it shows you the moment a "temporary" broad rule was added and never removed. Exposure gets caught as a finding instead of in an incident.