During testing PR https://github.com/openshift/installer/pull/9773 and https://github.com/openshift/installer/pull/10059 , new network nsg rule "alllow_ssh" for port 22 is created and never deleted after installation.

$ az network nsg rule list --nsg-name jima05subnetd-n5jjr-nsg -g jima05subnetd-n5jjr-rg -otable
Name                                                      ResourceGroup           Priority    SourcePortRanges    SourceAddressPrefixes    SourceASG    Access    Protocol    Direction    DestinationPortRanges    DestinationAddressPrefixes    DestinationASG
--------------------------------------------------------  ----------------------  ----------  ------------------  -----------------------  -----------  --------  ----------  -----------  -----------------------  ----------------------------  ----------------
apiserver_in                                              jima05subnetd-n5jjr-rg  101         *                   *                        None         Allow     Tcp         Inbound      6443                     *                             None
k8s-azure-lb_allow_IPv4_556f7044ec033071ec0dfcf7cd85bc93  jima05subnetd-n5jjr-rg  500         *                   Internet                 None         Allow     Tcp         Inbound      443 80                   20.225.5.134                  None
allow_ssh                                                 jima05subnetd-n5jjr-rg  2200        *                   *                        None         Allow     Tcp         Inbound      22                       *                             None

    4.21 

    Always

    1. Build image with PR installer#10059
    2. create cluster
    3.
    

    nsg rule "allow_ssh" for port 22 is created

    nsg rule "allow_ssh" for port 22 should not be created

    slack thread: https://redhat-internal.slack.com/archives/C01V1DP387R/p1762344654245479