A grain-elevator NSG has an Allow on TCP 443 at priority 400 and a…

Question

A grain-elevator NSG has an Allow on TCP 443 at priority 400 and a Deny on TCP 443 at priority 200. Operators argue the Allow should win because it was added last. Which rule takes effect?

Accepted Answer

The Deny at priority 200, because the lower priority number is evaluated first and wins. — NSG priority is a race number, not a calendar. Two hundred beats four hundred—so that Deny on 443 lands first and the late Allow never gets a turn.

Answer

The Allow at priority 400, because the newest rule always overrides older rules.

Answer

Neither rule, because unmatched traffic always uses the VirtualNetwork service tag allow.

Answer

Both rules merge into a soft allow that depends on the rule display name.

A grain-elevator NSG has an Allow on TCP 443 at priority 400 and a Deny on TCP 443 at priority 200. Operators argue the Allow should win because it was added last. Which rule takes effect?

Short Explanation

Full Explanation