Explanation/Reference:
Groups provide control over network traffic flowing in and out of your services running in Azure. Network Security Groups can also be applied to a subnet in a Virtual network thus they provide an efficient mechanism to administer access control rule updates across multiple VMs. Access control rules on hundreds or even thousands of machines can be changed in seconds, without any update or changes in the VM.
References: https://azure.microsoft.com/en-us/blog/network-security-groups/