Azure Policy definition Internet-facing virtual machines should be protected with network security groups. We need a security for each of the VMs for Internet- facing protection.
Note: A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.
We only need one security policy for disk encryption to apply on both for VM1 and VM2 (on all VMs).
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/policy-reference
https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
