Cloud firewall automation: Azure

Reach maintains one inbound rule in a network security group (NSG) of your choice, named reach-gateway, pointed at your team's gateway IP(s). Authentication uses an app registration in your own Entra ID tenant with the client-credentials flow, scoped to the NSG (or its resource group) with the built-in Network Contributor role.

What Reach manages

A single security rule on the NSG:

PropertyValue
Namereach-gateway
Direction / accessInbound / Allow
Priority3900
Sourceyour gateway IP(s) as /32 in sourceAddressPrefixes
Destination*
Destination portthe target's port, or * for all
ProtocolTcp, Udp or *
DescriptionManaged by TYO Reach — do not edit manually

Because all gateway IPs live in one rule's sourceAddressPrefixes, adding a region never adds a rule. Removing the target deletes the reach-gateway rule only.

1. Register an app and grant it Network Contributor

  1. Entra ID → App registrations → New registration. Name it e.g. tyo-reach-firewall. Note the Application (client) ID and Directory (tenant) ID.
  2. Certificates & secrets → New client secret. Copy the secret value now.
  3. Open the network security group (or its resource group to cover several NSGs) → Access control (IAM) → Add role assignment → Network Contributor → assign it to the app registration.

Network Contributor is the narrowest built-in role that can write NSG rules (Microsoft.Network/networkSecurityGroups/securityRules/write and /delete). If you use a custom role, include those two actions plus Microsoft.Network/networkSecurityGroups/read.

2. Connect the tenant

Cloud connections → Add connection → Azure, then enter Tenant ID, Subscription ID, App Client ID and Client Secret. Reach verifies by listing NSGs in the subscription — a 403 means the role assignment is missing or on the wrong scope; a 401 means one of the four values is wrong.

3. Add an NSG target

  1. Add target on the connection.
  2. Resource group and NSG name.
  3. Port and protocol — 3389/tcp for RDP, 22/tcp for SSH, or all.
  4. Save. Reach upserts the reach-gateway rule.

Verify with az cli

az network nsg rule show -g RESOURCE_GROUP --nsg-name NSG_NAME -n reach-gateway \
  -o table --query "{prio:priority, src:sourceAddressPrefixes, port:destinationPortRange, proto:protocol}"

Revoke

Delete the target (the rule is removed), then delete the app registration or its role assignment.

Common questions

Priority 3900 — will it conflict with my rules?

Only if you already use 3900 in that NSG. Move your rule; Reach's priority is fixed so it always sits below your explicit denies (lower numbers win) but above the default rules.

Can I point several NSGs at the same connection?

Yes — add one target per NSG. Each gets its own reach-gateway rule.

Does the app registration need Graph or directory permissions?

No. It only needs the RBAC assignment on the NSG/resource group. No API permissions, no admin consent.