nsg-new.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.2",
    "parameters": {
      "location": {
        "type": "string"
      },
      "nsgName": {
        "type": "string"
      },
      "srcIPInboundNSG": {
        "type": "string"
      },
      "virtualNetworkAddressPrefix": {
        "type": "string"
      }
  },
  "variables":
  {
      "apiVersion": "2015-06-15"
  },
  "resources": [
    {
        "apiVersion": "[variables('apiVersion')]",
        "type": "Microsoft.Network/networkSecurityGroups",
        "name": "[parameters('nsgName')]",
        "location": "[parameters('location')]",
        "properties": {
            "securityRules": [{
                "name": "Allow-Outside-From-IP",
                "properties": {
                    "description": "Rule",
                    "protocol": "*",
                    "sourcePortRange": "*",
                    "destinationPortRange": "*",
                    "sourceAddressPrefix": "[parameters('srcIPInboundNSG')]",
                    "destinationAddressPrefix": "*",
                    "access": "Allow",
                    "priority": 100,
                    "direction": "Inbound"
                }
            }, {
                "name": "Allow-Intra",
                "properties": {
                    "description": "Allow intra network traffic",
                    "protocol": "*",
                    "sourcePortRange": "*",
                    "destinationPortRange": "*",
                    "sourceAddressPrefix": "[parameters('virtualNetworkAddressPrefix')]",
                    "destinationAddressPrefix": "*",
                    "access": "Allow",
                    "priority": 101,
                    "direction": "Inbound"
                }
            }, {
                "name": "Default-Deny",
                "properties": {
                    "description": "Default-Deny if we don't match Allow rule",
                    "protocol": "*",
                    "sourcePortRange": "*",
                    "destinationPortRange": "*",
                    "sourceAddressPrefix": "*",
                    "destinationAddressPrefix": "*",
                    "access": "Deny",
                    "priority": 200,
                    "direction": "Inbound"
                }
            }]
        }
    }
  ],
  "outputs": {
  }
}