What is Azure Virtual Network?
Azure Virtual Network (VNet) is the fundamental networking building block in Azure. A VNet enables creating isolated, private networks in the cloud where Azure resources like VMs, App Services, and databases can communicate securely. VNets provide full control over IP address spaces, subnets, routing, and security policies.
VNets are the foundation for nearly every Azure architecture and enable secure hybrid connections to on-premises data centers via VPN Gateway or ExpressRoute.
Core Features
- Subnet segmentation: Divide the address space into subnets for different workloads and security zones
- Network security groups: Stateful firewall rules for inbound and outbound traffic at subnet and NIC level
- VNet peering: Connect multiple VNets over the Azure backbone without additional gateways
- Service endpoints: Direct, secure access to Azure PaaS services over the Azure backbone
- Private endpoints: Private IP addresses for Azure services within your VNet
Typical Use Cases
Multi-tier applications: Separation of web, application, and database tiers into different subnets with NSG rules for isolation.
Hybrid cloud: Connect Azure resources with on-premises data centers via Site-to-Site VPN or ExpressRoute.
Hub-and-spoke topology: Central hub VNet for shared services (firewall, DNS) with spoke VNets for individual workloads.
Benefits
- No charge for the VNet itself: Costs are incurred only for additional components such as gateways or peering traffic
- Full isolation: Dedicated IP address space without overlap with other tenants
- Flexible addressing: CIDR ranges from /2 to /29 with any number of subnets
- Azure-native integration: All Azure services support VNet integration
Frequently Asked Questions about Azure Virtual Network
Which IP ranges should I use?
Use RFC 1918 private ranges (10.x.x.x, 172.16.x.x, 192.168.x.x). Plan address spaces to avoid overlap with on-premises networks or other VNets.
What is the difference between service endpoints and private endpoints?
Service endpoints route traffic to Azure services over the backbone, but the service keeps its public IP. Private endpoints assign a private IP within your VNet to the service, so no traffic flows over public IPs.
How do I connect multiple VNets?
Use VNet peering for direct connections over the Azure backbone. For transitive communication between peered VNets, you additionally need Azure Firewall, an NVA, or Virtual WAN.
Can I expand a VNet after creation?
Yes, you can add address spaces to existing VNets. Overlapping ranges with peered VNets are not allowed. Subnets containing addresses already in use cannot be arbitrarily shrunk.
How do I secure a VNet?
Use network security groups for subnet-level filtering. For advanced threat protection, implement Azure Firewall or a network virtual appliance. Azure DDoS Protection additionally protects against volumetric attacks.
What does Azure Virtual Network cost?
There is no charge for the VNet itself. Costs are incurred for additional components such as VPN Gateway, ExpressRoute connectivity, cross-region peering traffic, or public IP addresses. See the pricing page for each additional component used for details.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Virtual Network: from network architecture for hub-and-spoke topologies to hybrid connectivity design to implementing zero trust network security.
Contact us for a non-binding consultation on Azure Virtual Network and Microsoft Azure.
Typical Use Cases
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
