Starting on 30 September 2025, default outbound connectivity for Azure VMs will be retired. This means that after this date you have to configure a way for virtual machines to actually have connection to the internet. Otherwise, you will get an VM that runs but is only available through your internal network.
In this post I will do a deep dive into this new developement and explain what is needed and what this means for your existing environment and how to transition to the new situation after this 30 September 2025 date.
Table of Contents
- What does this new requirement mean?
- Why would Microsoft choose for this?
- What to do with existing VMs?
- Summary
📖 Estimated read time: 4 minutes
🔄 Page last updated on: July 14, 2025What does this new requirement mean?
This requirement means that every virtual machine in Azure created after 30 September 2025 needs to have an outbound connectivity method configured. You can see this as a “bring your own connection”.
If you do not configure one of these methods, you will end up with a virtual machine that is not reachable from the internet. It can be reached from other servers (Jump servers) on the internal network or by using Azure Bastion.
The options in Azure we can use to facilitate outbound access are:
| Type | Pricing | When to use? |
| Public IP address | 4$ per VM per month | Single VMs |
| Load Balancer | 25$ – 75$ per network per month | Multiple different VMs (customizable SNAT) |
| NAT Gateway | 25$ – 40$ per subnet per month | Multiple similar VMs (default SNAT) |
| Azure Firewall | 800$ – 1300$ per network per month | To create complete cloud network with multiple servers |
| Other 3rd party Firewall/NVA | Depends on solution | To create complete cloud network with multiple servers |
To further explain what is going on with these types:
These are the Azure native solutions to achieve defualt outbound access with the details on the right.
This change means that Microsoft actually mark all subnets as “Private Subnet”, which you can already configure today:
Why would Microsoft choose for this?
There are some different reasons why Microsoft would choose to change this. It’s primary reason is to embrace the Zero Trust model, and so “secure-by-default”. Let’s find out all reasons:
- Security by default: Not connecting VMs to the internet that doesn’t need them increases security
- Predictable IP ranges: In the old situation, the outbound IP address could change anytime which increases confusion
- Explicit method: With this change you can choose what VMs need internet access and what VMs don’t. This because you actually have to configure them. In the old situation all VMs have internet access
- Cost management: The costs of the machines will be more expected as there will be less automated traffic and you can decide which VMs need internet access and what machines does not
What to do with existing VMs?
Existing VMs will not be impacted by this change.
Only when deploying a new VM after the migration date: 30 September 2025, the VM will not have outbound internet access and one of the methods must be configured.
Summary
I thnk this is a great change of Microsoft to change this behaviour. Yes, your environment will cost more, but the added security and easier manageability will really make up for it.
I hope I informed you about this change and thank you for reading.
Sources:
- https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access
- https://azure.microsoft.com/nl-nl/updates?id=default-outbound-access-for-vms-in-azure-will-be-retired-transition-to-a-new-method-of-internet-access
End of the page 🎉
You have reached the end of the page. You can select a category, share this post on X, LinkedIn and Reddit or return to the blog posts collection page. Thank you for visiting this post.
- Azure Master Class (12)
- Azure Virtual Desktop (17)
- Flying (15)
- Intune (3)
- Microsoft 365 (12)
- Microsoft Azure (27)
- Microsoft Defender XDR (4)
- Microsoft Entra (9)
- Networking (5)
- Powershell (18)
- Uncategorized (1)
- Windows 365 (2)
- Windows Server (12)
If you think something is wrong with this post or you want to know more, you can send me a message to one of my social profiles at: https://justinverstijnen.nl/about/
The terms and conditions apply to this post.
Page visitors: No page-counter data available yet.
