When you create or update a virtual network in your subscription, Network Watcher will be enabled automatically in your Virtual Network's region. There is no impact to your resources or associated charge for automatically enabling Network Watcher. For more information, see Network Watcher create.
Create a VM with a network security group
Enable Network Watcher (done by default with the vnet/subnet creation)
-- and register the Microsoft.Insights provider ---------todo
Enable a traffic flow log for an NSG, using Network Watcher's NSG flow log capability --todo BUT !
NSG flow log data is written to an Azure Storage account. Complete the following steps to create a storage account for the log data.
So you need to create a storage account before enable the NSG flow
Download logged data
View logged data
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal