Nist 800-171 rev 2 policy assignment error - Subnets should be associted with a network security group

Amit Raghav 40 Reputation points
2026-06-12T13:52:12.1633333+00:00

Hello

I am running NIST policy 800-171 rev 2 against my tenant and its failing compliance check for Azurefirewallmanagementsubnet subnet with error "Subnets should be associated with a network security group".

When I try to associate subnet to NSG, i get error "Failed to save network security group for subnet 'AzureFirewallManagementSubnet'. Error: Network security group BaselineNSG cannot be attached to firewall subnet AzureFirewallManagementSubnet."

This is GCCH environment. Is this known issue or bug?

Azure Policy
Azure Policy

An Azure service that is used to implement corporate governance and standards at scale for Azure resources.

0 comments
Answer accepted by question author

AI answer

2026-06-12T13:52:34.29+00:00

The behavior is expected, not a bug. Azure Firewall management subnets cannot have a Network Security Group associated, but the NIST SP 800-171 R2 initiative includes a generic policy that audits all subnets for NSG association.

In the NIST SP 800-171 R2 (including Azure Government) initiatives, the control for “Subnets should be associated with a Network Security Group” is mapped to NIST control 3.13.6 and is implemented as a single built-in policy that audits subnets for NSG association:

  • Policy: Subnets should be associated with a Network Security Group
  • Effect: AuditIfNotExists (or Audit/Deny in some initiatives)
  • Purpose: Enforce “deny by default, allow by exception” by requiring NSGs on subnets.

Azure Firewall’s AzureFirewallManagementSubnet is a special-purpose subnet that does not support NSG association. Because the policy is generic and evaluates all subnets, it flags this subnet as non-compliant even though attaching an NSG is blocked by the platform.

To handle this in a GCCH environment:

  1. Keep the NIST initiative assigned for overall compliance.
  2. Create a custom policy or initiative that:
    • Excludes the AzureFirewallManagementSubnet (or the containing virtual network/resource group) from the built-in NSG-on-subnets policy scope, or
    • Uses a condition to filter out subnets with the reserved name AzureFirewallManagementSubnet.
  3. Re-run compliance; the AzureFirewallManagementSubnet should no longer be reported as non-compliant while other subnets remain governed by the NSG requirement.

This aligns with the documented mapping of the NSG requirement to NIST SP 800-171 R2 3.13.6 and the Azure Government variant of the initiative.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.