New Azure networks no longer reach the internet on their own

For as long as most of us have used Azure, a new virtual machine could reach the internet the moment it started. You did not configure anything. Azure quietly assigned an outbound address behind the scenes and the machine could fetch its updates, call an API, or do anything else it liked.

That convenience was also a hole. A server that nobody decided should talk to the internet could talk to the internet, from an address you did not control and could not predict.

What changed

A new virtual machine, before and after the change

BeforeAzure quietly gave the machine a public address for outbound trafficIt could reach the internet without anyone deciding it should

NowA new network starts with private subnetsNothing leaves until you add a NAT gateway, a load balancer rule or a public address

Microsoft retired that default on 31 March 2026, after moving the date from September 2025. Virtual networks created after it start with private subnets. A machine placed in one has no path out until someone gives it one on purpose. The supported choices are a NAT gateway attached to the subnet, a standard load balancer with outbound rules, or a public address on the machine itself.

The scope is narrower than the early headlines suggested. Existing virtual networks are not changed, and machines added to them, old or new, carry on as before unless you switch the subnet to private yourself.

How it shows up

Usually as a puzzle. Somebody builds a new environment for a project, from a template that has worked for years. The machines start. Then Windows will not activate, updates fail, the deployment script cannot download a package, and an hour goes on checking firewalls that are not the problem. Microsoft's documentation notes that activation and Windows updates are among the services that do not function in a private subnet without an explicit route out.

If that sounds familiar from the last few months, this is very likely why.

What to do

For new work, put the outbound method in the template, so every network is born with one. For most small environments a NAT gateway is the simplest choice. Note that one gateway serves one virtual network, so count them when you estimate cost.

For older networks there is no deadline, and we would still move them. An explicit route means you know which address your traffic leaves from, which matters the first time a supplier asks you for one to put on an allow list. It also means a machine cannot reach the outside world by accident.

Where X-Axis fits

Network reviews and template updates are routine parts of our Azure consulting. How we work.

Keep reading

Azure4 min read

99.2%of account compromise attacks blocked by MFA, per Microsoft

Azure now asks your scripts for a second factor

Mandatory multifactor sign in reached the command line and deployment tools. If a nightly job runs under a person's account, it is living on borrowed time.

30 second answerAzure requires multifactor authentication for user accounts that manage resources through the CLI, PowerShell, SDKs and deployment tools. Service principals and managed identities are not affected. Move any automation that signs in as a person.

Azure3 min read

1 hourfor a first pass that usually pays for itself

Where an Azure bill drifts, and a one hour review that finds it

Cloud bills do not jump. They creep, a few dollars at a time, in places nobody owns. Here is where we look first.

30 second answerLook for disks and addresses attached to nothing, machines sized for a peak that never came, test environments running overnight, and anything without an owner tag. Then set a budget alert, so the next drift sends an email.

Microsoft 3654 min read

$1.50more per user, per month, on Business Standard

Your next Microsoft 365 renewal costs more. Here is the arithmetic.

List prices went up on 1 July 2026. Most firms will only notice when the renewal quote lands, so do the sum now.

30 second answerBusiness Basic went from $6 to $7 and Business Standard from $12.50 to $14 per user per month. Business Premium stayed at $22. You pay the new rate from your first renewal after 1 July 2026.