Which security control functions as a virtual firewall for Azure Virtual Networks?

Network Security Groups (NSGs) act as a virtual firewall for Azure Virtual Networks, allowing or denying inbound and outbound network traffic to resources like VMs. They use five-tuple (source IP, source port, destination IP, destination port, protocol) rules to filter traffic. Azure AD (Active Directory) is an identity and access management service, not a network firewall. Azure Key Vault securely stores cryptographic keys, secrets, and certificates, but doesn't filter network traffic. Azure DDoS Basic provides basic protection against Distributed Denial of Service attacks, but it's not a virtual firewall for general traffic filtering.