Azure Networking Cheat Sheet

Updated 2026-04-28

Next Topic: Content Delivery Networks - CDN Cheat Sheet

🧠Study flashcards on this topic101 cards · spaced repetition→

Azure Networking is Microsoft's comprehensive suite of cloud networking services that enable secure connectivity, traffic management, and network security for resources deployed in Azure. Operating across 60+ global AI regions with a backbone now exceeding 18 petabits per second of WAN capacity, Azure networking provides the foundation for hybrid cloud architectures, application delivery, and zero-trust security models. As of March 31, 2026, all newly created virtual networks default to private subnets with no default outbound internet access, requiring explicit methods (NAT Gateway, Load Balancer, or Public IP) — a fundamental shift toward secure-by-default network design. New services like Azure Virtual Network Manager, DNS Security Policy with Threat Intelligence, and StandardV2 NAT Gateway continue to raise the bar for enterprise-grade networking.

What This Cheat Sheet Covers

This topic spans 14 focused tables and 118 indexed concepts, 101 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Virtual Network FoundationsTable 2: VNet Peering and ConnectivityTable 3: Hybrid Connectivity – VPNTable 4: Hybrid Connectivity – ExpressRouteTable 5: Network Security – CoreTable 6: Network Security – AdvancedTable 7: Routing and Traffic ManagementTable 8: Load Balancing – Layer 4Table 9: Load Balancing – Layer 7Table 10: Global Traffic ManagementTable 11: Content Delivery and DNSTable 12: Advanced Virtual WANTable 13: Azure Virtual Network ManagerTable 14: Network Monitoring and Diagnostics

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Virtual Network Foundations

Everything in Azure networking starts with the VNet—your private slice of the cloud—and the pieces that fill it. These rows cover how you carve a VNet into subnets, attach NICs and IP addresses, and the gotchas worth committing to memory: Azure quietly reserves five IPs per subnet, and as of March 2026 new subnets ship with no default outbound internet access at all.

Concept	Example	Description
Virtual Network (VNet)	`10.0.0.0/16` address space	• Isolated private network in Azure • supports custom RFC 1918 address spaces and can be segmented into subnets, peered, or connected to on-premises.
Subnet	`10.0.1.0/24`	• Subdivision of a VNet • Azure reserves 5 IPs per subnet (first 4 and last 1), so a /29 gives only 3 usable IPs.
Subnet Delegation	Subnet delegated to `Microsoft.Web/serverFarms`	• Designates a subnet for injection of a specific Azure PaaS service • the service can add its own network intent policies (routes, NSG rules) to that subnet.
Address Space	`10.0.0.0/16, 172.16.0.0/16`	• CIDR blocks defining IP ranges for a VNet • can be expanded or added after creation without downtime if the new range contains all existing subnets.
Network Interface (NIC)	`nic-vm-01` attached to VM	• Virtual network adapter attached to a VM • can have multiple IP configurations (primary + secondary private IPs) and supports accelerated networking via SR-IOV.
Private IP Address	`10.0.1.5` (dynamic or static)	• IP assigned to NIC from subnet range • dynamic by default (DHCP, persists during stop/start) • static locks a specific IP permanently.
Public IP Address	`20.50.100.15` (Standard SKU)	• Internet-routable IP • Standard SKU is zone-redundant and requires explicit NSG rules • Basic SKU retired September 2025.
IP Configuration	Primary: `10.0.1.5` Secondary: `10.0.1.6`	• Binding of private IP (and optionally public IP) to NIC • one primary required • multiple secondary configs supported for multi-IP scenarios.
Private Subnet (default since March 2026)	Subnet with `defaultOutboundAccess: false`	• Subnet without default internet access • since March 31, 2026, all new VNets default to this, requiring NAT Gateway, Load Balancer, or Public IP for outbound.
Accelerated Networking	Enabled on NIC for supported VM sizes	• Uses SR-IOV to bypass the host networking stack • delivers up to 30 Gbps throughput and single-digit microsecond latency for supported VM sizes.

Table 2: VNet Peering and Connectivity

Once you have more than one VNet, peering is how you wire them together over the Microsoft backbone instead of the public internet. The key things to grasp here are that peering is non-transitive by default—spokes don't automatically talk to each other—and the tricks that work around it: gateway transit and service chaining are what make hub-and-spoke topologies possible.

Type	Example	Description
VNet Peering (Regional)	VNet-A ↔ VNet-B (same region)	• Direct network connection between VNets in the same Azure region • traffic stays on Microsoft backbone • non-transitive by default.

The rest of this section is part of the full cheat sheet

Table 3: Hybrid Connectivity – VPN

Connecting on-premises networks to Azure over encrypted tunnels across the public internet—the affordable, flexible half of hybrid connectivity. The choices that matter most are site-to-site versus point-to-site (whole network versus individual device) and route-based versus policy-based gateways, with active-active and BGP layered on when you need high availability and dynamic routing.

Service	Example	Description
VPN Gateway	`VpnGw2` SKU with 1.25 Gbps throughput	• Managed VPN service for encrypted connections over the internet • supports site-to-site, point-to-site, and VNet-to-VNet scenarios.

The rest of this section is part of the full cheat sheet

Table 4: Hybrid Connectivity – ExpressRoute

When a VPN over the internet isn't fast or reliable enough, ExpressRoute gives you a private, dedicated circuit straight into Microsoft's network—lower latency, higher bandwidth, and no public internet in the path. The rows distinguish the two peering types (private for your VNets, Microsoft for M365 and public services) and the higher-end options like ExpressRoute Direct, FastPath, and Global Reach that push scale, performance, and site-to-site reach.

Service	Example	Description
ExpressRoute	1 Gbps private circuit via provider	• Private, dedicated connection to Azure bypassing the public internet • provides lower latency, higher reliability, and up to 100 Gbps bandwidth.

The rest of this section is part of the full cheat sheet

Table 1: Virtual Network Foundations

Concept	Example	Description
Virtual Network (VNet)	`10.0.0.0/16` address space	• Isolated private network in Azure • supports custom RFC 1918 address spaces and can be segmented into subnets, peered, or connected to on-premises.
Subnet	`10.0.1.0/24`	• Subdivision of a VNet • Azure reserves 5 IPs per subnet (first 4 and last 1), so a /29 gives only 3 usable IPs.
Subnet Delegation	Subnet delegated to `Microsoft.Web/serverFarms`	• Designates a subnet for injection of a specific Azure PaaS service • the service can add its own network intent policies (routes, NSG rules) to that subnet.
Address Space	`10.0.0.0/16, 172.16.0.0/16`	• CIDR blocks defining IP ranges for a VNet • can be expanded or added after creation without downtime if the new range contains all existing subnets.
Network Interface (NIC)	`nic-vm-01` attached to VM	• Virtual network adapter attached to a VM • can have multiple IP configurations (primary + secondary private IPs) and supports accelerated networking via SR-IOV.
Private IP Address	`10.0.1.5` (dynamic or static)	• IP assigned to NIC from subnet range • dynamic by default (DHCP, persists during stop/start) • static locks a specific IP permanently.
Public IP Address	`20.50.100.15` (Standard SKU)	• Internet-routable IP • Standard SKU is zone-redundant and requires explicit NSG rules • Basic SKU retired September 2025.
IP Configuration	Primary: `10.0.1.5` Secondary: `10.0.1.6`	• Binding of private IP (and optionally public IP) to NIC • one primary required • multiple secondary configs supported for multi-IP scenarios.
Private Subnet (default since March 2026)	Subnet with `defaultOutboundAccess: false`	• Subnet without default internet access • since March 31, 2026, all new VNets default to this, requiring NAT Gateway, Load Balancer, or Public IP for outbound.
Accelerated Networking	Enabled on NIC for supported VM sizes	• Uses SR-IOV to bypass the host networking stack • delivers up to 30 Gbps throughput and single-digit microsecond latency for supported VM sizes.

Table 2: VNet Peering and Connectivity

Type	Example	Description
VNet Peering (Regional)	VNet-A ↔ VNet-B (same region)	• Direct network connection between VNets in the same Azure region • traffic stays on Microsoft backbone • non-transitive by default.

Table 3: Hybrid Connectivity – VPN

Service	Example	Description
VPN Gateway	`VpnGw2` SKU with 1.25 Gbps throughput	• Managed VPN service for encrypted connections over the internet • supports site-to-site, point-to-site, and VNet-to-VNet scenarios.

Table 4: Hybrid Connectivity – ExpressRoute

Service	Example	Description
ExpressRoute	1 Gbps private circuit via provider	• Private, dedicated connection to Azure bypassing the public internet • provides lower latency, higher reliability, and up to 100 Gbps bandwidth.