Last updated: May 2026

Azure Networking Beginner AZ-104 ⏱ 13 min read

Subnets & IP Addressing

Subnets divide your VNet into smaller network segments — letting you organise resources, apply security policies at different levels, and control traffic flow between tiers. IP addressing determines how resources identify and find each other. Getting subnet design right from the start saves a lot of pain later — you can't change a subnet's address range while resources are deployed in it.

What you'll learn What subnets are and why they matter · Subnet sizing and planning · Private IP addresses — dynamic vs static · Public IP addresses — Basic vs Standard SKU · Public IP prefixes · Service-dedicated subnets (Bastion, Gateway, Firewall) · Subnet delegation · Creating subnets via CLI

Table of Contents

What Are Subnets?
Subnet Sizing
Private IP Addresses
Public IP Addresses
Public IP Prefixes
Service-Dedicated Subnets
Subnet Delegation
Creating and Managing Subnets
Subnet Design Patterns
Practice Questions

What Are Subnets?

A subnet is a range of IP addresses within a VNet. You deploy resources into subnets — every VM NIC, every PaaS service that integrates with a VNet, must go into a subnet. Subnets serve two purposes:

Organisation — Group related resources (web tier, app tier, data tier) into separate subnets
Security — Apply NSGs to control traffic between subnets

ℹ️

Subnets Must Be Contiguous Each subnet's address range must be within the VNet's address space and cannot overlap with other subnets. If your VNet is 10.0.0.0/16, valid subnets include 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24, etc.

Subnet Sizing

Remember Azure reserves 5 IPs per subnet. Here's a quick guide for common subnet sizes:

CIDR	Total IPs	Usable IPs	Suitable For
/24	256	251	General-purpose subnet, most workloads
/25	128	123	Medium workload subnet
/26	64	59	Small subnet, Azure Bastion minimum
/27	32	27	Very small subnet
/28	16	11	Minimal subnet — VPN Gateway minimum
/29	8	3	Extremely limited — avoid

💡

Size Generously Always size subnets larger than you think you need. You cannot expand a subnet while resources are in it (without redeployment). A /24 costs nothing extra and gives you room to grow.

Private IP Addresses

Every resource in a subnet gets a private IP from the subnet's address range. Private IPs are used for communication within the VNet (and connected networks).

Dynamic vs Static Private IPs

	Dynamic	Static
Assignment	Azure assigns next available IP	You specify the IP address
Changes on restart?	No — stays the same (but not guaranteed forever)	Never changes
Changes on delete/recreate?	May change	Must be reassigned
Best for	Most VMs and resources	DNS servers, domain controllers, load balancers

Azure CLI Create a VM NIC with static private IP

# Create NIC with static private IP
az network nic create \
  --resource-group myRG \
  --name myNIC \
  --vnet-name myVNet \
  --subnet web-subnet \
  --private-ip-address 10.0.1.10

Public IP Addresses

Resources that need to be reachable from the internet require a public IP. Public IPs are separate resources that are attached to NICs, load balancers, or gateways.

	Basic SKU	Standard SKU
Assignment	Dynamic or static	Static only
Security	Open by default	Closed by default — NSG required
Zone support	No	Yes — zone-redundant or zonal
Load Balancer support	Basic LB only	Standard LB only
Recommended?	Legacy — avoid for new	Yes — always use Standard

⚠️

Always Use Standard SKU Basic public IPs are being retired. Always create Standard SKU public IPs for new resources. Standard IPs are closed by default (more secure) and support Availability Zones.

Azure CLI Create a Standard public IP (static)

# Create a Standard SKU static public IP
az network public-ip create \
  --resource-group myRG \
  --name myPublicIP \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3 \
  --location centralindia

Public IP Prefixes

A Public IP Prefix is a reserved contiguous block of Standard public IP addresses. Useful when you need multiple public IPs from the same range (for whitelisting in firewalls).

Service-Dedicated Subnets

Some Azure services require their own dedicated subnet with a specific name:

Service	Required Subnet Name	Minimum Size
Azure Bastion	AzureBastionSubnet	/26
VPN Gateway	GatewaySubnet	/27 (recommend /26)
Azure Firewall	AzureFirewallSubnet	/26
Azure Firewall Management	AzureFirewallManagementSubnet	/26
App Gateway v2	Any name	/24 recommended
Azure Route Server	RouteServerSubnet	/27

⚠️

Reserve These Subnets Early If you ever plan to add Bastion, VPN Gateway, or Azure Firewall to a VNet, pre-create their subnets immediately — even if you don't deploy the service yet. It's much easier than trying to carve out space later when the VNet is already populated.

Subnet Delegation

Subnet delegation allows you to designate a subnet for a specific Azure service — allowing that service to create resources in the subnet and manage certain configurations. Common delegated services:

Azure App Service (for VNet Integration)
Azure Kubernetes Service (for AKS node pools)
Azure NetApp Files
Azure SQL Managed Instance

ℹ️

Delegation is Exclusive A delegated subnet can only contain resources from the delegated service — you cannot mix regular VMs with a delegated subnet's resources.

Creating and Managing Subnets

Azure CLI Common subnet management commands

# Add a subnet
az network vnet subnet create \
  --name data-subnet \
  --resource-group myRG \
  --vnet-name myVNet \
  --address-prefix 10.0.3.0/24

# List subnets
az network vnet subnet list \
  --resource-group myRG \
  --vnet-name myVNet \
  --output table

# Show subnet details
az network vnet subnet show \
  --resource-group myRG \
  --vnet-name myVNet \
  --name data-subnet

# Update subnet (e.g., add NSG)
az network vnet subnet update \
  --resource-group myRG \
  --vnet-name myVNet \
  --name data-subnet \
  --network-security-group myNSG

Subnet Design Patterns

A typical 3-tier application subnet layout:

Subnet	CIDR	Resources	NSG
AzureBastionSubnet	10.0.0.0/26	Azure Bastion	Bastion NSG
GatewaySubnet	10.0.0.64/27	VPN Gateway	None (required)
web-subnet	10.0.1.0/24	Web VMs, App Gateway	Allow 80/443 inbound
app-subnet	10.0.2.0/24	Application VMs	Allow only from web-subnet
data-subnet	10.0.3.0/24	SQL, databases	Allow only from app-subnet

💡

AZ-104 Exam Tip Know the required subnet names for Bastion (AzureBastionSubnet /26), VPN Gateway (GatewaySubnet /27+), and Azure Firewall (AzureFirewallSubnet /26). Know the difference between Basic and Standard SKU public IPs. Know that Azure reserves 5 IPs per subnet.

📝 Practice Questions

Click an option to check your answer. AZ-104 style questions.

Q1. What is the minimum subnet size required for Azure Bastion?

A /28

B /27

C /26

D /24

Q2. What is the key difference between Basic and Standard SKU public IP addresses?

A Basic supports static only; Standard supports both dynamic and static

B Standard is closed by default (more secure) and zone-redundant; Basic is open and no zone support

C Only Standard supports static assignment

D Basic is regional; Standard is global

Q3. What is the required subnet name for a VPN Gateway?

A AzureBastionSubnet

B GatewaySubnet

C AzureFirewallSubnet

D VPNGatewaySubnet

Q4. A VM has a dynamic private IP. What happens to this IP when the VM is stopped and deallocated?

A The IP is released and a different IP may be assigned on restart

B The IP is retained — dynamic private IPs persist through stop/start cycles

C The IP is automatically converted to static

D The IP is permanently deleted

Q5. What is subnet delegation used for?

A Assigning administrative permissions to manage a subnet

B Designating a subnet for exclusive use by a specific Azure service

C Allowing public internet traffic into a private subnet

D Enabling cross-VNet routing between subnets

← Previous Virtual Networks (VNet) Next → Network Security Groups

Comments

Disclaimer: RedKite Cloud is an independent educational resource and is not affiliated with Microsoft Corporation.