Azure Subnets: Designing Virtual Networks in Microsoft Azure
Microsoft Azure is one of the world's leading cloud platforms, and at the heart of every Azure deployment is the Virtual Network (VNet). Within each VNet, subnets provide the fundamental network segmentation that enables secure, organized, and scalable cloud architectures. Whether you are deploying a simple virtual machine or a complex multi-tier application, understanding Azure subnets is essential for building reliable cloud infrastructure on Azure.
What Is an Azure Subnet?
An Azure subnet is a logical partition of a Virtual Network that defines a range of IP addresses within the VNet's address space. Subnets allow you to segment your network for security, traffic management, and resource organization. Each Azure subnet has a unique CIDR block that must fall within the parent VNet's address range. Unlike AWS subnets which are tied to a single Availability Zone, Azure subnets can span multiple Availability Zones within the same region, giving you flexibility in how you distribute resources across fault domains.
Azure reserves 5 IP addresses in every subnet: the first address (network), the second (Azure default gateway), the third and fourth (Azure DNS and reserved), and the last (broadcast). This means a /24 subnet in Azure has only 251 usable addresses rather than the expected 254. The minimum subnet size Azure allows is /29, which provides 8 total addresses but only 3 usable ones—generally impractical for production use. A /28 or larger is recommended. The Azure subnet calculator automatically accounts for these reservations when planning your VNet.
Azure VNet and Subnet Architecture
An Azure VNet is the foundation of network connectivity in Azure. It defines an IP address space (typically using RFC 1918 private ranges like 10.0.0.0/8 or 172.16.0.0/12) and acts as a container for subnets. Subnets inherit the routing and security policies applied to the VNet while adding their own layer of access control through Network Security Groups (NSGs). NSGs act as a distributed firewall, allowing you to define inbound and outbound rules based on source/destination IP, port, and protocol. Unlike AWS NACLs which are stateless, Azure NSGs can be stateful, simplifying rule creation.
Azure supports both regional subnets (which span all Availability Zones in a region) and zone-redundant deployments. This is a key difference from AWS where each subnet is confined to a single Availability Zone. In Azure, you deploy resources into a subnet and then specify the Availability Zone at the resource level. This architecture provides more flexibility in IP address planning because you do not need dedicated subnets for each AZ. The Azure subnet calculator helps you choose the optimal CIDR size and see the usable address range after Azure's reservations.
Subnet Security and Connectivity
Subnet-level security in Azure is managed through Network Security Groups (NSGs) and service endpoints. NSGs filter traffic at the subnet or NIC level based on rules you define. Service endpoints allow you to secure Azure service access (like Azure Storage or SQL Database) to only your VNet, eliminating exposure over the public internet. VNet peering enables connectivity between VNets in the same or different regions, with traffic flowing over the Microsoft backbone network. Azure Bastion provides secure RDP/SSH access to VMs without exposing public IPs.
For hybrid connectivity, Azure supports VPN gateways (site-to-site and point-to-site) and Azure ExpressRoute for dedicated private connections to on-premises networks. These connections attach at the VNet level and provide access to all subnets within the VNet. Proper subnet planning ensures that your IP address space does not overlap with on-premises networks, which would prevent VPN or ExpressRoute connectivity.
A well-designed Azure subnet strategy follows best practices: use a /16 VNet to leave room for growth, deploy subnets at /24 or larger for production workloads, separate application tiers into different subnets, use NSGs for micro-segmentation, and plan for regional expansion. The Azure subnet calculator on this page makes it easy to explore different CIDR configurations and understand the impact of Azure's reserved addresses on your usable IP space. Whether you are preparing for the AZ-900 or AZ-104 certification or designing a production Azure environment, mastering subnet planning is a foundational skill.