Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Microsoft Azure Removes Default Internet Access for New Virtual Networks

Microsoft Azure Removes Default Internet Access for New Virtual Networks

Written By Anoop C Nair
Last Updated February 13, 2026
Posted In Azure AD
SHARE

Key Takeaways

  • Azure Removes Default Internet Access
  • After March 31, 2026, newly created Azure Virtual Networks (VNets) will not have internet access by default.
  • This change applies only to new VNets created after the deadline.
  • Existing VNets are not affected and will continue to work as they do today.

Here, we are discussing Microsoft Azure Removes Default Internet Access for New Virtual Networks. According to the latest news coming that After March 31, 2026, any newly created Virtual Network (VNet) will no longer have automatic access to the internet. This update was highlighted by Christiaan Brinkhoff on his social media platform.

Table of Contents

Does this affect existing VNets? 

No. Only new VNets created after March 31, 2026, are affected. Existing VNets will continue to operate as normal.

Do Microsoft Hosted Network deployments require changes?

No. MHN already includes managed egress.

Microsoft Azure Removes Default Internet Access for New Virtual Networks

When you create a VNet in Azure, virtual machines and other resources can reach the internet by default without extra setup. With the upcoming change, this behavior will stop. If your workloads need internet access for updates, app downloads, or external services, you will need to configure outbound access manually.

Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.1
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.1

Upcoming Default Outbound Access

Default Outbound Access (DOA) will no longer be enabled for new VNets. This is the new changes DOA in Azure. Instead, VNets will default to the Private Subnet option, blocking internet access unless explicitly configured. It helps improve security and compliance by keeping workloads isolated unless internet access is intentionally allowed.

  • If an admin needs DOA, they can turn off the Private Subnet option but azure suggesting using the Azure NAT Gateway.
Supported outbound internet access optionsInfo
NAT Gateway (recommended)This is the best and most secure option.
Azure Standard Load BalancerCan be used to provide outbound access but requires careful configuration.
Azure Firewall or third-party network appliances (NVA)These can be used, but they are not recommended for long-running connections like RDP, because automatic scaling can interrupt sessions.
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Table.1
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.2 Creds to MS
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.2 Creds to MS

Virtual Network

Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. VNet enables many types of Azure resources, such as Azure Virtual Machines (VM), to securely communicate with each other, the internet, and on-premises networks. VNet is similar to a traditional network that you’d operate in your own data center but brings with it additional benefits of Azure’s infrastructure such as scale, availability, and isolation.

Patch My PC
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.3
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.3

How This Change Affects Windows 365 and What You Should Do

For Windows 365 deployments using Azure Network Connection (ANC), new virtual networks created after March 31, 2026 will be private by default. This means internet access must be configured manually. If outbound access is not enabled, Cloud PC provisioning will fail. Existing VNets are not affected.

  • There is no impact if you use a Microsoft-hosted network, as Microsoft manages connectivity and provides internet access by default.
  • To avoid issues, review your network setup early.
  • If possible, move to a Microsoft-hosted network, or explicitly enable outbound access using a NAT Gateway and test connectivity before deployment.
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.4 Creds to MS
Microsoft Azure Removes Default Internet Access for New Virtual Networks -Fig.4 Creds to MS

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community  and WhatsApp Channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Author

Anoop C Nair has been Microsoft MVP for 10 consecutive years from 2015 onwards. He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM,  Windows,  Cloud PC,  Windows, Entra, Microsoft Security, Career, etc.

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Azure AD

PowerShell Script to Track Upcoming Microsoft Entra App Secret Expirations

PowerShell Script to Track Upcoming Microsoft Entra App Secret Expirations! In this article, I’ll walk you through a powerful automation designed to enhance proactive security and lifecycle management for Microsoft Entra applications. You’ll learn how to monitor Entra app registrations and automate the detection of upcoming secret key expirations, ensuring your identity infrastructure stays secure […]

SN Sujin Nelladath 7 min read
Azure AD

How New TURN Relay IP Range Enhances RDP Shortpath for AVD and Windows 365

Let’s discuss How New TURN Relay IP Range Enhances RDP Shortpath for AVD and Windows 365. Microsoft is going to launch a new improvement on Windows 365 and Azure Virtual Desktop called TURN relay. This is a dedicated IP range across the Microsoft Azure public cloud. TURN Relays new range 51.5.0.0/16 enhances RDP Shortpath connectivity […]

AC Anoop C Nair 4 min read
Azure AD

How to use Entra Require App Protection Policy in Conditional Access for Secure Access

Hey there, Let’s discuss about enable the Require app protection policy setting in conditional access. The “Require app protection policy” setting in Conditional Access is a security feature designed to ensure that access to corporate resources is only granted through apps that have specific protection policies applied. What is conditional access? yes, we all know […]

AC Anoop C Nair 3 min read