Announcing the public preview for the ability to create private subnets.
Currently, when virtual machines are created in a virtual network without any explicit outbound connectivity, they are assigned a default outbound public IP address. These implicit IPs are subject to change, not associated with a subscription, difficult to troubleshoot, and do not follow Azure's model of "secure by default" which ensures customers have strong security without additional steps needed. (The depreciation for this type of implicit connectivity was recently announced and is scheduled for September 2025.)
The private subnet feature will let you prevent this insecure implicit connectivity for any newly created subnets by setting the "default outbound access" parameter to false. You can then pick your preferred method for explicit outbound connectivity to the internet.
For more information on private subnets and default outbound access, see our documentation.