Best practices regarding use of NSGs versus NextGen Firewall appliances in Azure environments

[Mike_O]

As resources are shifting from on-premise to Azure, I'm looking for perspectives on best practices for when to use a NextGen firewall appliance in addition or in place of the Azure NSGs.

My understanding is that the NSG essentially only provides the firewall rule type of functionality and not some of the features that would typically be associated with a NextGen firewall (intrusion prevention, virus prevention, web content filtering, etc.).  As my typical thinking would be that any office where business is performed is best served by having a perimeter NGFW, I am slow to understand scenarios where I would not want them in Azure as well and am looking for other perspectives or how others are deploying in their environments.  

Thank you in advance for any input!

[#2]

@Mike_O You can use a NGFW for your cloud environment, to add additional security and have more advance filtering and detections. Azure NSG provide a virtual firewall to allow or deny specific ports or protocols. 

for NSG best practice follow below blog

https://blogs.msdn.microsoft.com/igorpag/2016/05/14/azure-network-security-groups-nsg-best-practices...