diff --git a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityGroup.java b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityGroup.java
index 1eaac5b1e17a..8a952d269c10 100644
--- a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityGroup.java
+++ b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityGroup.java
@@ -83,7 +83,7 @@ interface DefinitionWithRule {
          * @param name the name for the new security rule
          * @return the first stage of the security rule definition
          */
-        NetworkSecurityRule.DefinitionBlank<DefinitionCreatable> defineRule(String name);
+        NetworkSecurityRule.Definables.Blank<DefinitionCreatable> defineRule(String name);
     }
 
     /**
@@ -91,7 +91,8 @@ interface DefinitionWithRule {
      */
     interface UpdateWithRule {
         Update withoutRule(String name);
-        //TODO defineRule(String name)...
+        NetworkSecurityRule.UpdateDefinables.Blank<Update> defineRule(String name);
+        NetworkSecurityRule.Update updateRule(String name);
     }
 
     /**
diff --git a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityRule.java b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityRule.java
index 80581a1b822b..50d279131485 100644
--- a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityRule.java
+++ b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/NetworkSecurityRule.java
@@ -11,6 +11,7 @@
 import com.microsoft.azure.management.network.implementation.api.SecurityRuleProtocol;
 import com.microsoft.azure.management.resources.fluentcore.arm.models.ChildResource;
 import com.microsoft.azure.management.resources.fluentcore.model.Attachable;
+import com.microsoft.azure.management.resources.fluentcore.model.Settable;
 import com.microsoft.azure.management.resources.fluentcore.model.Wrapper;
 
 /**
@@ -52,7 +53,6 @@ public static Direction fromString(String s) {
         }
     }
 
-
     /**
      * The possible access types supported by a network security rule.
      */
@@ -165,181 +165,534 @@ public static Protocol fromString(String s) {
      * The entirety of a network security rule definition.
      * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
      */
-    interface Definitions<ParentT> extends
-        DefinitionBlank<ParentT>,
-        DefinitionAttachable<ParentT>,
-        DefinitionWithDirectionAccess<ParentT>,
-        DefinitionWithProtocol<ParentT>,
-        DefinitionWithSourceAddress<ParentT>,
-        DefinitionWithSourcePort<ParentT>,
-        DefinitionWithDestinationAddress<ParentT>,
-        DefinitionWithDestinationPort<ParentT> {
+    interface Definition<ParentT> extends
+        Definables.Blank<ParentT>,
+        Definables.WithAttach<ParentT>,
+        Definables.WithDirectionAccess<ParentT>,
+        Definables.WithSourceAddress<ParentT>,
+        Definables.WithSourcePort<ParentT>,
+        Definables.WithDestinationAddress<ParentT>,
+        Definables.WithDestinationPort<ParentT>,
+        Definables.WithProtocol<ParentT> {
     }
 
     /**
-     * The first stage of the subnet definition.
+     * The entirety of a network security rule definition as part of a network security group update.
      * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
      */
-    interface DefinitionBlank<ParentT> extends DefinitionWithDirectionAccess<ParentT> {
+    interface UpdateDefinition<ParentT> extends
+        UpdateDefinables.Blank<ParentT>,
+        UpdateDefinables.WithDirectionAccess<ParentT>,
+        UpdateDefinables.WithSourceAddress<ParentT>,
+        UpdateDefinables.WithSourcePort<ParentT>,
+        UpdateDefinables.WithDestinationAddress<ParentT>,
+        UpdateDefinables.WithDestinationPort<ParentT>,
+        UpdateDefinables.WithProtocol<ParentT>,
+        UpdateDefinables.WithAttach<ParentT> {
     }
 
     /**
-     * The stage of the network rule definition allowing the direction and the access type to be specified.
-     * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+     * The entirety of a security rule update as part of a network security group update.
      */
-    interface DefinitionWithDirectionAccess<ParentT> {
+    interface Update extends
+        Updatables.WithDirectionAccess,
+        Updatables.WithSourceAddress,
+        Updatables.WithSourcePort,
+        Updatables.WithDestinationAddress,
+        Updatables.WithDestinationPort,
+        Updatables.WithProtocol,
+        Settable<NetworkSecurityGroup.Update> {
+
         /**
-         * Allows inbound traffic.
-         * @return the next stage of the security rule definition
+         * Specifies the priority to assign to this rule.
+         * <p>
+         * Security rules are applied in the order of their assigned priority.
+         * @param priority the priority number in the range 100 to 4096
+         * @return the next stage of the update
          */
-        DefinitionWithSourceAddress<ParentT> allowInbound();
+        Update withPriority(int priority);
+    }
 
+    /**
+     * Grouping of security rule update stages.
+     */
+    interface Updatables {
         /**
-         * Allows outbound traffic.
-         * @return the next stage of the security rule definition
+         * The stage of the network rule description allowing the direction and the access type to be specified.
          */
-        DefinitionWithSourceAddress<ParentT> allowOutbound();
+        interface WithDirectionAccess {
+            /**
+             * Allows inbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            Update allowInbound();
+
+            /**
+             * Allows outbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            Update allowOutbound();
+
+            /**
+             * Blocks inbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            Update denyInbound();
+
+            /**
+             * Blocks outbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            Update denyOutbound();
+        }
 
         /**
-         * Blocks inbound traffic.
-         * @return the next stage of the security rule definition
+         * The stage of the network rule description allowing the source address to be specified.
          */
-        DefinitionWithSourceAddress<ParentT> denyInbound();
+        interface WithSourceAddress {
+            /**
+             * Specifies the traffic source address prefix to which this rule applies.
+             * @param cidr an IP address prefix expressed in the CIDR notation
+             * @return the next stage of the security rule definition
+             */
+            Update fromAddress(String cidr);
+
+            /**
+             * Specifies that the rule applies to any traffic source address.
+             * @return the next stage of the security rule definition
+             */
+            Update fromAnyAddress();
+        }
 
         /**
-         * Blocks outbound traffic.
-         * @return the next stage of the security rule definition
+         * The stage of the network rule description allowing the source port(s) to be specified.
          */
-        DefinitionWithSourceAddress<ParentT> denyOutbound();
-    }
+        interface WithSourcePort {
+            /**
+             * Specifies the source port to which this rule applies.
+             * @param port the source port number
+             * @return the next stage of the security rule definition
+             */
+            Update fromPort(int port);
+
+            /**
+             * Makes this rule apply to any source port.
+             * @return the next stage of the security rule definition
+             */
+            Update fromAnyPort();
+
+            /**
+             * Specifies the source port range to which this rule applies.
+             * @param from the starting port number
+             * @param to the ending port number
+             * @return the next stage of the security rule definition
+             */
+            Update fromPortRange(int from, int to);
+        }
 
-    /**
-     * The stage of the network rule definition allowing the source address to be specified.
-     * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
-     */
-    interface DefinitionWithSourceAddress<ParentT> {
         /**
-         * Specifies the traffic source address prefix to which this rule applies.
-         * @param cidr an IP address prefix expressed in the CIDR notation
-         * @return the next stage of the security rule definition
+         * The stage of the network rule description allowing the destination address to be specified.
          */
-        DefinitionWithSourcePort<ParentT> fromAddress(String cidr);
+        interface WithDestinationAddress {
+            /**
+             * Specifies the traffic destination address range to which this rule applies.
+             * @param cidr an IP address range expressed in the CIDR notation
+             * @return the next stage of the security rule definition
+             */
+            Update toAddress(String cidr);
+
+            /**
+             * Makes the rule apply to any traffic destination address.
+             * @return the next stage of the security rule definition
+             */
+            Update toAnyAddress();
+        }
+
+        /**
+         * The stage of the network rule description allowing the destination port(s) to be specified.
+         */
+        interface WithDestinationPort {
+            /**
+             * Specifies the destination port to which this rule applies.
+             * @param port the destination port number
+             * @return the next stage of the security rule definition
+             */
+            Update toPort(int port);
+
+            /**
+             * Makes this rule apply to any destination port.
+             * @return the next stage of the security rule definition
+             */
+            Update toAnyPort();
+
+            /**
+             * Specifies the destination port range to which this rule applies.
+             * @param from the starting port number
+             * @param to the ending port number
+             * @return the next stage of the security rule definition
+             */
+            Update toPortRange(int from, int to);
+        }
 
         /**
-         * Specifies that the rule applies to any traffic source address.
-         * @return the next stage of the security rule definition
+         * The stage of the security rule description allowing the protocol that the rule applies to to be specified.
          */
-        DefinitionWithSourcePort<ParentT> fromAnyAddress();
+        interface WithProtocol {
+            /**
+             * Specifies the protocol that this rule applies to.
+             * @param protocol one of the supported protocols
+             * @return the next stage of the security rule definition
+             */
+            Update withProtocol(Protocol protocol);
+
+            /**
+             * Makes this rule apply to any supported protocol.
+             * @return the next stage of the security rule definition
+             */
+            Update withAnyProtocol();
+        }
     }
 
+
     /**
-     * The stage of the network rule definition allowing the source port(s) to be specified.
-     * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+     * Grouping of security rule definition stages applicable as part of a network security group update.
      */
-    interface DefinitionWithSourcePort<ParentT> {
+    interface UpdateDefinables {
         /**
-         * Specifies the source port to which this rule applies.
-         * @param port the source port number
-         * @return the next stage of the security rule definition
+         * The first stage of a security rule description as part of an update of a networking security group.
+         * @param <ParentT> the return type of the final {@link UpdateDefinitionAttachable#attach()}
          */
-        DefinitionWithDestinationAddress<ParentT> fromPort(int port);
+        interface Blank<ParentT> extends WithDirectionAccess<ParentT> {
+        }
 
         /**
-         * Makes this rule apply to any source port.
-         * @return the next stage of the security rule definition
+         * The stage of the network rule definition allowing the direction and the access type to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionWithDestinationAddress<ParentT> fromAnyPort();
+        interface WithDirectionAccess<ParentT> {
+            /**
+             * Allows inbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> allowInbound();
+
+            /**
+             * Allows outbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> allowOutbound();
+
+            /**
+             * Blocks inbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> denyInbound();
+
+            /**
+             * Blocks outbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> denyOutbound();
+        }
 
         /**
-         * Specifies the source port range to which this rule applies.
-         * @param from the starting port number
-         * @param to the ending port number
-         * @return the next stage of the security rule definition
+         * The stage of the network rule definition allowing the source address to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionWithDestinationAddress<ParentT> fromPortRange(int from, int to);
-    }
+        interface WithSourceAddress<ParentT> {
+            /**
+             * Specifies the traffic source address prefix to which this rule applies.
+             * @param cidr an IP address prefix expressed in the CIDR notation
+             * @return the next stage of the security rule definition
+             */
+            WithSourcePort<ParentT> fromAddress(String cidr);
+
+            /**
+             * Specifies that the rule applies to any traffic source address.
+             * @return the next stage of the security rule definition
+             */
+            WithSourcePort<ParentT> fromAnyAddress();
+        }
+
+        /**
+         * The stage of the network rule definition allowing the source port(s) to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+         */
+        interface WithSourcePort<ParentT> {
+            /**
+             * Specifies the source port to which this rule applies.
+             * @param port the source port number
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationAddress<ParentT> fromPort(int port);
+
+            /**
+             * Makes this rule apply to any source port.
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationAddress<ParentT> fromAnyPort();
+
+            /**
+             * Specifies the source port range to which this rule applies.
+             * @param from the starting port number
+             * @param to the ending port number
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationAddress<ParentT> fromPortRange(int from, int to);
+        }
 
-    /**
-     * The stage of the network rule definition allowing the destination address to be specified.
-     * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
-     */
-    interface DefinitionWithDestinationAddress<ParentT> {
         /**
-         * Specifies the traffic destination address range to which this rule applies.
-         * @param cidr an IP address range expressed in the CIDR notation
-         * @return the next stage of the security rule definition
+         * The stage of the network rule definition allowing the destination address to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionWithDestinationPort<ParentT> toAddress(String cidr);
+        interface WithDestinationAddress<ParentT> {
+            /**
+             * Specifies the traffic destination address range to which this rule applies.
+             * @param cidr an IP address range expressed in the CIDR notation
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationPort<ParentT> toAddress(String cidr);
+
+            /**
+             * Makes the rule apply to any traffic destination address.
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationPort<ParentT> toAnyAddress();
+        }
 
         /**
-         * Makes the rule apply to any traffic destination address.
-         * @return the next stage of the security rule definition
+         * The stage of the network rule definition allowing the destination port(s) to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+         */
+        interface WithDestinationPort<ParentT> {
+            /**
+             * Specifies the destination port to which this rule applies.
+             * @param port the destination port number
+             * @return the next stage of the security rule definition
+             */
+            WithProtocol<ParentT> toPort(int port);
+
+            /**
+             * Makes this rule apply to any destination port.
+             * @return the next stage of the security rule definition
+             */
+            WithProtocol<ParentT> toAnyPort();
+
+            /**
+             * Specifies the destination port range to which this rule applies.
+             * @param from the starting port number
+             * @param to the ending port number
+             * @return the next stage of the security rule definition
+             */
+            WithProtocol<ParentT> toPortRange(int from, int to);
+        }
+
+        /**
+         * The stage of the security rule definition allowing the protocol that the rule applies to to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+         */
+        interface WithProtocol<ParentT> {
+            /**
+             * Specifies the protocol that this rule applies to.
+             * @param protocol one of the supported protocols
+             * @return the next stage of the security rule definition
+             */
+            WithAttach<ParentT> withProtocol(Protocol protocol);
+
+            /**
+             * Makes this rule apply to any supported protocol.
+             * @return the next stage of the security rule definition
+             */
+            WithAttach<ParentT> withAnyProtocol();
+        }
+
+        /** The final stage of the security rule definition.
+         * <p>
+         * At this stage, any remaining optional settings can be specified, or the security rule definition
+         * can be attached to the parent network security group definition using {@link WithAttach#attach()}.
+         * @param <ParentT> the return type of {@link WithAttach#attach()}
          */
-        DefinitionWithDestinationPort<ParentT> toAnyAddress();
+        interface WithAttach<ParentT> extends Attachable.InUpdate<ParentT> {
+
+            /**
+             * Specifies the priority to assign to this rule.
+             * <p>
+             * Security rules are applied in the order of their assigned priority.
+             * @param priority the priority number in the range 100 to 4096
+             * @return the next stage of the update
+             */
+            WithAttach<ParentT> withPriority(int priority);
+        }
     }
 
     /**
-     * The stage of the network rule definition allowing the destination port(s) to be specified.
-     * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+     * Grouping of security rule definition stages applicable as part of a network security group creation.
      */
-    interface DefinitionWithDestinationPort<ParentT> {
+    interface Definables {
         /**
-         * Specifies the destination port to which this rule applies.
-         * @param port the destination port number
-         * @return the next stage of the security rule definition
+         * The first stage of a security rule definition.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionWithProtocol<ParentT> toPort(int port);
+        interface Blank<ParentT> extends WithDirectionAccess<ParentT> {
+        }
 
         /**
-         * Makes this rule apply to any destination port.
-         * @return the next stage of the security rule definition
+         * The stage of the security rule definition allowing the protocol that the rule applies to to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionWithProtocol<ParentT> toAnyPort();
+        interface WithProtocol<ParentT> {
+            /**
+             * Specifies the protocol that this rule applies to.
+             * @param protocol one of the supported protocols
+             * @return the next stage of the security rule definition
+             */
+            WithAttach<ParentT> withProtocol(Protocol protocol);
+
+            /**
+             * Makes this rule apply to any supported protocol.
+             * @return the next stage of the security rule definition
+             */
+            WithAttach<ParentT> withAnyProtocol();
+        }
 
         /**
-         * Specifies the destination port range to which this rule applies.
-         * @param from the starting port number
-         * @param to the ending port number
-         * @return the next stage of the security rule definition
+         * The stage of the network rule definition allowing the destination port(s) to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionWithProtocol<ParentT> toPortRange(int from, int to);
-    }
+        interface WithDestinationPort<ParentT> {
+            /**
+             * Specifies the destination port to which this rule applies.
+             * @param port the destination port number
+             * @return the next stage of the security rule definition
+             */
+            WithProtocol<ParentT> toPort(int port);
+
+            /**
+             * Makes this rule apply to any destination port.
+             * @return the next stage of the security rule definition
+             */
+            WithProtocol<ParentT> toAnyPort();
+
+            /**
+             * Specifies the destination port range to which this rule applies.
+             * @param from the starting port number
+             * @param to the ending port number
+             * @return the next stage of the security rule definition
+             */
+            WithProtocol<ParentT> toPortRange(int from, int to);
+        }
 
-    /**
-     * The stage of the security rule definition allowing the protocol that the rule applies to to be specified.
-     * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
-     */
-    interface DefinitionWithProtocol<ParentT> {
         /**
-         * Specifies the protocol that this rule applies to.
-         * @param protocol one of the supported protocols
-         * @return the next stage of the security rule definition
+         * The stage of the network rule definition allowing the destination address to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionAttachable<ParentT> withProtocol(Protocol protocol);
+        interface WithDestinationAddress<ParentT> {
+            /**
+             * Specifies the traffic destination address range to which this rule applies.
+             * @param cidr an IP address range expressed in the CIDR notation
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationPort<ParentT> toAddress(String cidr);
+
+            /**
+             * Makes the rule apply to any traffic destination address.
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationPort<ParentT> toAnyAddress();
+        }
 
         /**
-         * Makes this rule apply to any supported protocol.
-         * @return the next stage of the security rule definition
+         * The stage of the network rule definition allowing the source port(s) to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
          */
-        DefinitionAttachable<ParentT> withAnyProtocol();
-    }
+        interface WithSourcePort<ParentT> {
+            /**
+             * Specifies the source port to which this rule applies.
+             * @param port the source port number
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationAddress<ParentT> fromPort(int port);
+
+            /**
+             * Makes this rule apply to any source port.
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationAddress<ParentT> fromAnyPort();
+
+            /**
+             * Specifies the source port range to which this rule applies.
+             * @param from the starting port number
+             * @param to the ending port number
+             * @return the next stage of the security rule definition
+             */
+            WithDestinationAddress<ParentT> fromPortRange(int from, int to);
+        }
 
-    /** The final stage of the security rule definition.
-     * <p>
-     * At this stage, any remaining optional settings can be specified, or the security rule definition
-     * can be attached to the parent network security group definition using {@link DefinitionAttachable#attach()}.
-     * @param <ParentT> the return type of {@link DefinitionAttachable#attach()}
-     */
-    interface DefinitionAttachable<ParentT> extends
-        Attachable<ParentT> {
+        /**
+         * The stage of the network rule definition allowing the source address to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+         */
+        interface WithSourceAddress<ParentT> {
+            /**
+             * Specifies the traffic source address prefix to which this rule applies.
+             * @param cidr an IP address prefix expressed in the CIDR notation
+             * @return the next stage of the security rule definition
+             */
+            WithSourcePort<ParentT> fromAddress(String cidr);
+
+            /**
+             * Specifies that the rule applies to any traffic source address.
+             * @return the next stage of the security rule definition
+             */
+            WithSourcePort<ParentT> fromAnyAddress();
+        }
 
         /**
-         * Specifies the priority to assign to this rule.
+         * The stage of the network rule definition allowing the direction and the access type to be specified.
+         * @param <ParentT> the return type of the final {@link DefinitionAttachable#attach()}
+         */
+        interface WithDirectionAccess<ParentT> {
+            /**
+             * Allows inbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> allowInbound();
+
+            /**
+             * Allows outbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> allowOutbound();
+
+            /**
+             * Blocks inbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> denyInbound();
+
+            /**
+             * Blocks outbound traffic.
+             * @return the next stage of the security rule definition
+             */
+            WithSourceAddress<ParentT> denyOutbound();
+        }
+
+        /** The final stage of the security rule definition.
          * <p>
-         * Security rules are applied in the order of their assigned priority.
-         * @param priority the priority number in the range 100 to 4096
-         * @return the next stage of the update
+         * At this stage, any remaining optional settings can be specified, or the security rule definition
+         * can be attached to the parent network security group definition using {@link WithAttach#attach()}.
+         * @param <ParentT> the return type of {@link WithAttach#attach()}
          */
-        DefinitionAttachable<ParentT> withPriority(int priority);
+        interface WithAttach<ParentT> extends Attachable.InDefinition<ParentT> {
+
+            /**
+             * Specifies the priority to assign to this rule.
+             * <p>
+             * Security rules are applied in the order of their assigned priority.
+             * @param priority the priority number in the range 100 to 4096
+             * @return the next stage of the update
+             */
+            WithAttach<ParentT> withPriority(int priority);
+        }
     }
-}
+ }
diff --git a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkInterfaceImpl.java b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkInterfaceImpl.java
index 075a39272615..ef4c9a12a3f6 100644
--- a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkInterfaceImpl.java
+++ b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkInterfaceImpl.java
@@ -199,7 +199,7 @@ public NicIpConfigurationImpl updateIpConfiguration(String name) {
                 return (NicIpConfigurationImpl) nicIpConfiguration;
             }
         }
-        throw new RuntimeException("An Ip configuration with name'" + name + "' not found");
+        throw new RuntimeException("IP configuration '" + name + "' not found");
     }
 
     @Override
diff --git a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityGroupImpl.java b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityGroupImpl.java
index 5b4dbff2d08b..8992773d8c17 100644
--- a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityGroupImpl.java
+++ b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityGroupImpl.java
@@ -63,6 +63,24 @@ private void initializeRulesFromInner() {
 
     // Verbs
 
+    @Override
+    public NetworkSecurityRuleImpl updateRule(String name) {
+        for (NetworkSecurityRule r : this.rules) {
+            if (r.name().equalsIgnoreCase(name)) {
+                return (NetworkSecurityRuleImpl) r;
+            }
+        }
+        throw new RuntimeException("Network security rule '" + name + "' not found");
+    }
+
+    @Override
+    public NetworkSecurityRuleImpl defineRule(String name) {
+        SecurityRuleInner inner = new SecurityRuleInner();
+        inner.withName(name);
+        inner.withPriority(100); // Must be at least 100
+        return new NetworkSecurityRuleImpl(name, inner, this);
+    }
+
     @Override
     public NetworkSecurityGroupImpl refresh() throws Exception {
         ServiceResponse<NetworkSecurityGroupInner> response =
@@ -110,14 +128,6 @@ public void success(ServiceResponse<Void> result) {
 
     // Setters (fluent)
 
-    @Override
-    public NetworkSecurityRuleImpl defineRule(String name) {
-        SecurityRuleInner inner = new SecurityRuleInner();
-        inner.withName(name);
-        inner.withPriority(100); // Must be at least 100
-        return new NetworkSecurityRuleImpl(name, inner, this);
-    }
-
     @Override
     public Update withoutRule(String name) {
         // Remove from cache
diff --git a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityRuleImpl.java b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityRuleImpl.java
index d3ca42f67506..e68501da7a49 100644
--- a/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityRuleImpl.java
+++ b/azure-mgmt-network/src/main/java/com/microsoft/azure/management/network/implementation/NetworkSecurityRuleImpl.java
@@ -17,7 +17,9 @@ class NetworkSecurityRuleImpl
     extends ChildResourceImpl<SecurityRuleInner, NetworkSecurityGroupImpl>
     implements
         NetworkSecurityRule,
-        NetworkSecurityRule.Definitions<NetworkSecurityGroup.DefinitionCreatable> {
+        NetworkSecurityRule.Definition<NetworkSecurityGroup.DefinitionCreatable>,
+        NetworkSecurityRule.UpdateDefinition<NetworkSecurityGroup.Update>,
+        NetworkSecurityRule.Update {
 
     protected NetworkSecurityRuleImpl(String name, SecurityRuleInner inner, NetworkSecurityGroupImpl parent) {
         super(name, inner, parent);
@@ -202,4 +204,9 @@ public NetworkSecurityGroupImpl attach() {
         this.parent().inner().securityRules().add(this.inner());
         return this.parent();
     }
+
+    @Override
+    public NetworkSecurityGroupImpl set() throws Exception {
+        return this.parent();
+    }
 }
diff --git a/azure-mgmt-resources/src/main/java/com/microsoft/azure/management/resources/fluentcore/model/Attachable.java b/azure-mgmt-resources/src/main/java/com/microsoft/azure/management/resources/fluentcore/model/Attachable.java
index cb4bb079fe10..3c6d652c6bd6 100644
--- a/azure-mgmt-resources/src/main/java/com/microsoft/azure/management/resources/fluentcore/model/Attachable.java
+++ b/azure-mgmt-resources/src/main/java/com/microsoft/azure/management/resources/fluentcore/model/Attachable.java
@@ -17,4 +17,22 @@ public interface Attachable<ParentT> {
      * @return the next stage of the parent object's definition
      */
     ParentT attach();
+
+    /**
+     * The final stage of the child object definition, as which it can be attached to the parent
+     * as part of the parent's definition, using {@link InDefinition#attach()}.
+     * @param <ParentT> the parent definition {@link InDefinition#attach()} returns to
+     */
+    interface InDefinition<ParentT> {
+        ParentT attach();
+    }
+
+    /**
+     * The final stage of the child object definition, as which it can be attached to the parent
+     * as part of the parent's update, using {@link InUpdate#attach()}.
+     * @param <ParentT> the parent definition {@link InUpdate#attach()} returns to
+     */
+    interface InUpdate<ParentT> {
+        ParentT attach();
+    }
 }
diff --git a/azure/src/test/java/com/microsoft/azure/TestNSG.java b/azure/src/test/java/com/microsoft/azure/TestNSG.java
index f9758d602797..c4c67094a3e1 100644
--- a/azure/src/test/java/com/microsoft/azure/TestNSG.java
+++ b/azure/src/test/java/com/microsoft/azure/TestNSG.java
@@ -21,8 +21,11 @@ public class TestNSG extends TestTemplate<NetworkSecurityGroup, NetworkSecurityG
     @Override
     public NetworkSecurityGroup createResource(NetworkSecurityGroups nsgs) throws Exception {
         final String newName = "nsg" + this.testId;
-        return nsgs.define(newName)
-                .withRegion(Region.US_WEST)
+        Region region = Region.US_WEST;
+
+        // Create
+        NetworkSecurityGroup nsg = nsgs.define(newName)
+                .withRegion(region)
                 .withNewGroup()
                 .defineRule("rule1")
                     .allowOutbound()
@@ -42,6 +45,12 @@ public NetworkSecurityGroup createResource(NetworkSecurityGroups nsgs) throws Ex
                     .withPriority(200)
                     .attach()
                 .create();
+
+        // Verify
+        Assert.assertTrue(nsg.region() == region.toString());
+        Assert.assertTrue(nsg.securityRules().size() == 2);
+
+        return nsg;
     }
 
     @Override
@@ -50,6 +59,21 @@ public NetworkSecurityGroup updateResource(NetworkSecurityGroup resource) throws
                 .withoutRule("rule1")
                 .withTag("tag1", "value1")
                 .withTag("tag2", "value2")
+                .defineRule("rule3")
+                    .allowInbound()
+                    .fromAnyAddress()
+                    .fromAnyPort()
+                    .toAnyAddress()
+                    .toAnyPort()
+                    .withProtocol(Protocol.UDP)
+                    .attach()
+                .withoutRule("rule1")
+                .updateRule("rule2")
+                    .denyInbound()
+                    .fromAddress("100.0.0.0/29")
+                    .fromPort(88)
+                    .withPriority(300)
+                    .set()
                 .apply();
         Assert.assertTrue(resource.tags().containsKey("tag1"));
         return resource;