If Azure Network Security Groups are stateless, are outbound DENYs overridden?

0
votes

I wish to know how Azure NSGs work when it comes to statefulness and Denys.

For example, let's compare to AWS security groups.

# Example AWS Security Group inbound/outbound rules
Inbound: Port 80 from the internet
Outbound: Port 443 to the internet

Because of statefulness, even though I only allow 443 outbound implicitly, 80 outbound is allowed due to statefulness.

Do Azure NSGs work the same way? If I have an implicit Deny on all outbound traffic but have an Inbound rule for port 80 from some service, will outbound traffic to that service still be allowed over port 80 even with the implicit outbound deny rule?

Thanks

azurenetworkingnetwork-security-groups