{"id":24851,"date":"2026-03-23T12:57:46","date_gmt":"2026-03-23T12:57:46","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=24851"},"modified":"2026-03-23T14:13:57","modified_gmt":"2026-03-23T14:13:57","slug":"when-to-add-subnets-to-an-azure-virtual-network","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=24851","title":{"rendered":"When To Add Subnets To An Azure Virtual Network"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this post, I want to explain the <em>real<\/em> reasons to add subnets to an Azure virtual network. This post is born out of frustration. I&#8217;ve seen post after post on social media, particularly on LinkedIn, where the poster has &#8220;Azure expert&#8221; in their description, and sharing advice from the year 2002 for cable-oriented (on-prem) networks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The BS Advice<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider the scenario below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"386\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4-1024x386.png\" alt=\"\" class=\"wp-image-24853\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4-1024x386.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4-300x113.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4-768x289.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4-1536x579.png 1536w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4-2048x772.png 2048w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-4-1200x452.png 1200w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The above diagram shows us the commonly advised Virtual Network architecture for a 3-tier web app. There are 3 tiers. The poster will say:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Each tier should have its own subnet for security reasons. Each subnet will have an NSG.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">So if we have web servers, app servers, and database servers, the logic is that the subnet + NSG combination provides security. The poster is half right:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The NSG does micro-segmentation of the machines.<\/li>\n\n\n\n<li>The subnets do nothing<em>.<\/em><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Back To The Basics &#8230; Again<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">I want you to do this:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build a VNet with 2 subnets.<\/li>\n\n\n\n<li>Build 2 VMs, each attached to a different subnet.<\/li>\n\n\n\n<li>Log into one of the VMs.<\/li>\n\n\n\n<li>Run tracert to the second VM.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">What will you see? The next and only hop <em>is the second VM.<\/em> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ping the default gateway. What happens? Timeouts. The default gateway does not exist.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is easily explained: <a href=\"https:\/\/aidanfinn.com\/?p=23991\" target=\"_blank\" rel=\"noopener\" title=\"\">Virtual Networks do not exist<\/a>. Subnets do not exist.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-2.png\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Think of a Virtual Network as a Venn diagram. Our two virtual machines are in the same circle. That is an instruction to the Azure fabric to say:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">These machines are permitted to route to each other<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s how Coca-Cola and PepsiCo could both have Virtual Networks with overlapping address spaces in the same Azure room and not be able to talk to each other.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Note: This is functionality of VXLAN implemented through the Hyper-V switch extension capability that was introduced in Windows Server 2012.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Simple Example<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let us fix that simple example. We will first understand that NSGs offer segmentation. No matter how I associate an NSG, the rules are always applied on the host virtual switch port (in Hyper-V, that&#8217;s on the NIC). If a rule says &#8220;no&#8221; then that packet is automatically dropped. If a rule says &#8220;yes&#8221;, then the packet is permitted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the diagram below, we accept that subnets play no role in security segmentation. We have flattened the network to a single subnet. There is a single web server, app server, and database server &#8211; we will add complexity later:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"647\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5-1024x647.png\" alt=\"\" class=\"wp-image-24863\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5-1024x647.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5-300x190.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5-768x485.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5-1536x971.png 1536w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5-2048x1294.png 2048w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-5-1200x758.png 1200w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This network is much simpler, right? And it offers no less security than the needlessly more complicated first example. An NSG is associated with the subnet. NSG rules allow the required traffic, and a low-priority rule denies all other traffic. Only the permitted traffic can enter any specific NIC.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I&#8217;ve seen arguments that this will create complicated rules. Pah! I&#8217;ve built\/migrated more apps than I care to remember. The rules for these apps are hardly ever that numerous.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aidan, what if I am going to run a highly available application? Lucky for you if the code supports that (seriously!). Whether you&#8217;re using availability sets or availability zones (lucky you, these days), we will make a tiny design change.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"777\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7-1024x777.png\" alt=\"\" class=\"wp-image-24866\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7-1024x777.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7-300x228.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7-768x583.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7-1536x1166.png 1536w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7-2048x1555.png 2048w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-7-1200x911.png 1200w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We will create a (free) Application Security Group (ASG) for each tier. We will then use the ASG as the source and destination instead of the VM IP addresses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aidan, what if I&#8217;m going to use Virtual Machine Scale Sets (VMSS)? It&#8217;s no different: you add the ASG for the tier to the networking properties of the VMSS. Each created VMSS instance will automatically be associated with the ASG.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When Should I Add Subnets? <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are several reasons why you should add subnets. I&#8217;ll list them first before I demonstrate them:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure requires it<\/li>\n\n\n\n<li>Unique routing<\/li>\n\n\n\n<li>Remote network sources<\/li>\n\n\n\n<li>Scaling<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Azure Requires It<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are scenarios when Azure requires a dedicated subnet. Some that I can immediately think of are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Virtual Network Gateway<\/li>\n\n\n\n<li>Azure Route Server<\/li>\n\n\n\n<li>SQL Managed Instance (MI)<\/li>\n\n\n\n<li>App Service Regional Virtual Network Integration<\/li>\n\n\n\n<li>App Service Environment (ASE &#8211; App Service Isolated Tier) VNet injection<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s PaaS-ify the developers (see what I did there :D) and move from VMs to PaaS. We will replace the web servers with App Services and the database with SQL MI:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The web servers ran two apps, Web and API. Each will have a Private Endpoint for ingress traffic. The Private Endpoints can remain in the General Subnet.<\/li>\n\n\n\n<li>The web servers must talk to the app servers (still VMs) over the VNet, so they will get Regional VNet Integration via the App Service Plan. This will require a dedicated subnet for egress only. This subnet will have no ingress.<\/li>\n\n\n\n<li>SQL MI requires a dedicated subnet.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"401\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9-1024x401.png\" alt=\"\" class=\"wp-image-24880\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9-1024x401.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9-300x117.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9-768x301.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9-1536x601.png 1536w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9-2048x802.png 2048w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-9-1200x470.png 1200w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Unique Routing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Next-hop routing is always executed by the source Azure NIC. Every subnet has a collective set of routes to destination prefixes (network addresses). Those routes are propagated to the NICs in that subnet (subnets do not exist). The NICs decide the next hop for each packet, and the Azure network fabric sends the packet (by VXLAN) directly to the NIC of the next hop<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There may be a situation where you want to customise routing. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For the sake of consistency, I&#8217;m going to use our web app, but in a little wonky way. My app is expanding. Some more VMs are being added for custom processing. Those VMs are being added to the GeneralSubnet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">My wonky scenario is that the security team have decided that traffic from the App Servers to the SQL VM must go through a firewall &#8211; that implies that the return traffic must also go through the firewall. No other traffic <em>inside <\/em>the app needs to go through the firewall. The firewall is deployed in a peered hub.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"338\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10-1024x338.png\" alt=\"\" class=\"wp-image-24885\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10-1024x338.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10-300x99.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10-768x254.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10-1536x507.png 1536w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10-2048x677.png 2048w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/03\/image-10-1200x396.png 1200w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">That means that I must split the GeneralSubnet into two source routing domains (subnets):<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>GeneralSubnet<\/strong>: Containing the Private Endpoint NICs and my new custom processing VMs.<\/li>\n\n\n\n<li><strong>AppServerSubnet<\/strong>: Containing only the app server VMs.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">We will implement the desired via-firewall routing using User-Defined Routes in Route Tables:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AppServerSubnet<\/strong>: Go via the hub firewall to get to SqlMiSubnet.<\/li>\n\n\n\n<li><strong>SqlMiSubnet<\/strong>: Go via the hub firewall to get to AppServerSunet.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Remote Network Sources<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">So far, we have been using Application Security Groups (ASGs) to abstract IP addresses in our NSGs. ASGs are great, but they have restrictions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewalls, including Azure Firewall, have no idea what an ASG is. You will have to use IP addresses as the sources in the firewall rules &#8211; possibly abstracted as IP Groups (Azure Firewall) or similar in third-party firewalls.<\/li>\n\n\n\n<li>ASGs can only be used inside their parent subscription. You&#8217;re not going to be able to use them as sources in other workloads if you follow the subscription\/workload approach of application landing zones.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Using an IP address(es) as a source is OK if the workload does not autoscale. What happens if your app tier\/role uses autoscaling and addresses are mixed with addresses from other tiers\/roles that should not have access to a remote resource?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There is only one way to solve this: break the source resource(s) out into their own subnet. I recently saw this one with a multi-subscription workload where there was going to be an Azure-hosted DevOps agent pool. Originally, the autoscaling pool was going to share a subnet with other VMs. However, I needed to grant HTTPS access to the DevOps pool <em>only<\/em> to all other resources. I couldn&#8217;t do that if the DevOps pool remained in a shared subnet. I split the pool into its own subnet and was able to use that subnet&#8217;s prefix as the source in the various firewall\/NSG rules.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Scaling<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are two scaling scenarios that I can think of at the moment. You will have some workload component that will autoscale. The autoscaling role\/tier requires a large number of IPs that you want to dedicate to that role\/tier. In this case, yes, you may dedicate a subnet to that role\/tier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second scenario is that you have followed a good practice of deploying a relatively small VNet for your workload, with some spare capacity for additional subnets. However, the scope of the workload has changed significantly. The spare capacity will not be enough. You need to expand the VNet, so you add a second IP prefix to the VNet. This means that new IP capacity requires additional subnets from the new prefix.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">In Summary<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every diagram for a new VNet in Azure should start very simply: 1 subnet. Do not follow the overly-simple advice from &#8220;Azure expert&#8221;LinkedIn posts that say &#8220;create a subnet for every tier to create a security boundary&#8221;. You absolutely do not need to do that! Most workloads, even in large enterprises, are incredibly simple, and one subnet will suffice. You should only add subnets when the need requires it, as documented above.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I&#8217;ve seen post after post on social media, particularly on LinkedIn, where the poster has &#8220;Azure expert&#8221; in their description, and sharing advice from the year 2002 for cable-oriented (on-prem) &hellip; <a href=\"https:\/\/aidanfinn.com\/?p=24851\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;When To Add Subnets To An Azure Virtual Network&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":24071,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[5],"tags":[170,320,253,190,319],"class_list":["post-24851","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure","tag-network-security-group","tag-nsg","tag-security","tag-subnet"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I&#039;ve seen post after post on social media, particularly on LinkedIn, where the poster has &quot;Azure expert&quot; in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"AFinn\"\/>\n\t<meta name=\"google-site-verification\" content=\"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/aidanfinn.com\/?p=24851\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro\" \/>\n\t\t<meta property=\"og:description\" content=\"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I&#039;ve seen post after post on social media, particularly on LinkedIn, where the poster has &quot;Azure expert&quot; in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/aidanfinn.com\/?p=24851\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-23T12:57:46+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-03-23T14:13:57+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@joe_elway\" \/>\n\t\t<meta name=\"twitter:title\" content=\"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro\" \/>\n\t\t<meta name=\"twitter:description\" content=\"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I&#039;ve seen post after post on social media, particularly on LinkedIn, where the poster has &quot;Azure expert&quot; in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@joe_elway\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#article\",\"name\":\"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro\",\"headline\":\"When To Add Subnets To An Azure Virtual Network\",\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/ArchitectBluePrintCloudNetwork.jpg\",\"width\":1024,\"height\":1024,\"caption\":\"Architect Blueprint Cloud Networks\"},\"datePublished\":\"2026-03-23T12:57:46+00:00\",\"dateModified\":\"2026-03-23T14:13:57+00:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#webpage\"},\"articleSection\":\"Azure, Azure, Network Security Group, NSG, Security, Subnet\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/aidanfinn.com\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5#listItem\",\"name\":\"Azure\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5#listItem\",\"position\":2,\"name\":\"Azure\",\"item\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#listItem\",\"name\":\"When To Add Subnets To An Azure Virtual Network\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#listItem\",\"position\":3,\"name\":\"When To Add Subnets To An Azure Virtual Network\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5#listItem\",\"name\":\"Azure\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#webpage\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851\",\"name\":\"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro\",\"description\":\"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I've seen post after post on social media, particularly on LinkedIn, where the poster has \\\"Azure expert\\\" in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/ArchitectBluePrintCloudNetwork.jpg\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851\\\/#mainImage\",\"width\":1024,\"height\":1024,\"caption\":\"Architect Blueprint Cloud Networks\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24851#mainImage\"},\"datePublished\":\"2026-03-23T12:57:46+00:00\",\"dateModified\":\"2026-03-23T14:13:57+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/\",\"name\":\"Aidan Finn, IT Pro\",\"description\":\"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro","description":"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I've seen post after post on social media, particularly on LinkedIn, where the poster has \"Azure expert\" in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)","canonical_url":"https:\/\/aidanfinn.com\/?p=24851","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aidanfinn.com\/?p=24851#article","name":"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro","headline":"When To Add Subnets To An Azure Virtual Network","author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"publisher":{"@id":"https:\/\/aidanfinn.com\/#person"},"image":{"@type":"ImageObject","url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/ArchitectBluePrintCloudNetwork.jpg","width":1024,"height":1024,"caption":"Architect Blueprint Cloud Networks"},"datePublished":"2026-03-23T12:57:46+00:00","dateModified":"2026-03-23T14:13:57+00:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/aidanfinn.com\/?p=24851#webpage"},"isPartOf":{"@id":"https:\/\/aidanfinn.com\/?p=24851#webpage"},"articleSection":"Azure, Azure, Network Security Group, NSG, Security, Subnet"},{"@type":"BreadcrumbList","@id":"https:\/\/aidanfinn.com\/?p=24851#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/#listItem","position":1,"name":"Home","item":"https:\/\/aidanfinn.com\/","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=5#listItem","name":"Azure"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=5#listItem","position":2,"name":"Azure","item":"https:\/\/aidanfinn.com\/?cat=5","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=24851#listItem","name":"When To Add Subnets To An Azure Virtual Network"},"previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=24851#listItem","position":3,"name":"When To Add Subnets To An Azure Virtual Network","previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=5#listItem","name":"Azure"}}]},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/#person","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=24851#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/?author=1#author","url":"https:\/\/aidanfinn.com\/?author=1","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=24851#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"WebPage","@id":"https:\/\/aidanfinn.com\/?p=24851#webpage","url":"https:\/\/aidanfinn.com\/?p=24851","name":"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro","description":"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I've seen post after post on social media, particularly on LinkedIn, where the poster has \"Azure expert\" in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/aidanfinn.com\/#website"},"breadcrumb":{"@id":"https:\/\/aidanfinn.com\/?p=24851#breadcrumblist"},"author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"creator":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"image":{"@type":"ImageObject","url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/ArchitectBluePrintCloudNetwork.jpg","@id":"https:\/\/aidanfinn.com\/?p=24851\/#mainImage","width":1024,"height":1024,"caption":"Architect Blueprint Cloud Networks"},"primaryImageOfPage":{"@id":"https:\/\/aidanfinn.com\/?p=24851#mainImage"},"datePublished":"2026-03-23T12:57:46+00:00","dateModified":"2026-03-23T14:13:57+00:00"},{"@type":"WebSite","@id":"https:\/\/aidanfinn.com\/#website","url":"https:\/\/aidanfinn.com\/","name":"Aidan Finn, IT Pro","description":"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","inLanguage":"en-GB","publisher":{"@id":"https:\/\/aidanfinn.com\/#person"}}]},"og:locale":"en_GB","og:site_name":"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","og:type":"article","og:title":"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro","og:description":"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I've seen post after post on social media, particularly on LinkedIn, where the poster has &quot;Azure expert&quot; in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)","og:url":"https:\/\/aidanfinn.com\/?p=24851","article:published_time":"2026-03-23T12:57:46+00:00","article:modified_time":"2026-03-23T14:13:57+00:00","twitter:card":"summary","twitter:site":"@joe_elway","twitter:title":"When To Add Subnets To An Azure Virtual Network | Aidan Finn, IT Pro","twitter:description":"In this post, I want to explain the real reasons to add subnets to an Azure virtual network. This post is born out of frustration. I've seen post after post on social media, particularly on LinkedIn, where the poster has &quot;Azure expert&quot; in their description, and sharing advice from the year 2002 for cable-oriented (on-prem)","twitter:creator":"@joe_elway"},"aioseo_meta_data":{"post_id":"24851","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"titles":[],"descriptions":[],"socialPosts":{"email":[],"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-03-21 10:24:43","updated":"2026-03-23 16:08:33","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\/?cat=5\" title=\"Azure\">Azure<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tWhen To Add Subnets To An Azure Virtual Network\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/aidanfinn.com\/"},{"label":"Azure","link":"https:\/\/aidanfinn.com\/?cat=5"},{"label":"When To Add Subnets To An Azure Virtual Network","link":"https:\/\/aidanfinn.com\/?p=24851"}],"amp_enabled":true,"jetpack_featured_media_url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/ArchitectBluePrintCloudNetwork.jpg","_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/24851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=24851"}],"version-history":[{"count":30,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/24851\/revisions"}],"predecessor-version":[{"id":24888,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/24851\/revisions\/24888"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/media\/24071"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}