Azure: new virtual networks no longer reach the internet by default

Until now, an Azure virtual machine with no outbound method configured still got a Microsoft public IP to reach the internet. That is called default outbound access. Microsoft is retiring it: in new virtual networks, subnets are now private from the start.

What changes

• With API versions released after March 31, 2026, subnets in a new virtual network have defaultOutboundAccess set to false. The Azure portal already created them that way.
• A virtual machine in a private subnet cannot reach the internet or public Microsoft endpoints without an explicit method. That includes Windows activation and updates.
• Existing virtual networks do not change, nor do their current machines or new ones created in them.
• Older templates (ARM, Terraform) pinned to an earlier API version keep creating subnets with the old behavior.

Since when

Since March 31, 2026. Microsoft first announced September 30, 2025 and then moved the date.

Who it affects

• Anyone creating new virtual networks in Azure, by hand or with infrastructure as code.
• Anyone relying on the default outbound IP, which Microsoft owns and can change without notice.

What to do

1. In Azure Advisor, look for the recommendation to add an explicit outbound method: it lists the machines using default outbound today.
2. Pick the outbound method: NAT Gateway on the subnet (Microsoft’s recommendation for most cases), outbound rules on a standard load balancer, a standard public IP on the machine, or a firewall with defined routes.
3. Set it up before you switch an existing subnet to private. Machines must be stopped and deallocated for the change to apply.
4. Review your templates and Terraform modules: decide each subnet’s outbound method instead of inheriting the default.

Let’s review your Azure network’s internet egress.

Microsoft source:

• https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access