Merge pull request #206949 from Blackmist/nsg-note

Batch/NSG note

Author: prmerger-automator[bot]

articles/machine-learning/how-to-secure-training-vnet.md

@@ -84,6 +84,13 @@ In this article you learn how to secure the following training compute resources
 
     * One network security group (NSG). This NSG contains the following rules, which are specific to compute cluster and compute instance:
 
+        > [!IMPORTANT]
+        > Compute instance and compute cluster automatically create an NSG with the required rules.
+        > 
+        > If you have another NSG at the subnet level, the rules in the subnet level NSG mustn't conflict with the rules in the automatically created NSG.
+        >
+        > To learn how the NSGs filter your network traffic, see [How network security groups filter network traffic](/azure/virtual-network/network-security-group-how-it-works).
+
         * Allow inbound TCP traffic on ports 29876-29877 from the `BatchNodeManagement` service tag.
         * Allow inbound TCP traffic on port 44224 from the `AzureMachineLearning` service tag.