Has anyone had a problem with creating application security groups before network interface? If interface is build second error regarding duplicate resource URN appears but if interface is build first, with no additional changes everything passes. We would like to build asg than in moment of creation of nics to add asg args.

Sounds like an undocumented azure implicit ordering dependency. You can tell pulumi to deploy one after the other with the

dependsOn

property. I can't say I've run into your exact situation, as we attach NSGs to subnets, but I've seen these azure quirks all over the place in other resources.

If you're getting an error on duplicate resource URN that probably means you're using the same logical name for two different Pulumi resources. An application security group has no dependencies on anything but a resource group so you shouldn't have any problems creating that before the NIC.