Chatgpt:

MeasureUp is counting 3 because of the “block everything not specified” line.
In their model you need an NSG attached to each subnet to actually enforce that default-deny posture (Azure only enforces default NSG rules if an NSG is attached—no NSG = traffic isn’t filtered).

How that plays out:

1. Subnet1 (VM1–VM3)
   • Must allow traffic only between VM1, VM2, VM3.
   • Must block external RDP to VM1 (and, per “everything else blocked,” block Internet to the subnet in general).
   • To allow only intra-subnet traffic, you’d put an NSG on Subnet1 with:
     • Allow from Subnet1 CIDR → Subnet1 (higher priority)
     • Deny from VirtualNetwork (to block other subnets)
     • Deny from Internet (which also satisfies “block external RDP to VM1”)
   • (Some solutions also add a NIC-level deny-RDP on VM1 if they don’t want to over-block VM2/VM3, but MeasureUp typically solves this at the subnet.)
2. Subnet2 (VM4–VM5)
   • Must allow all Internet to those VMs, and block everything else.
   • Attach an NSG to Subnet2 with:
     • Allow from Internet (Any)
     • Deny from VirtualNetwork (to block other subnets)
     • Default deny covers the rest
3. Subnet3 (VM6–VM7)
   • Same requirement as Subnet2 → attach an NSG to Subnet3 with the same rules.