We are announcing the general availability of private subnet functionality in Azure.
Currently, when virtual machines are created
in a virtual network without any explicit outbound connectivity, they are
assigned a default outbound public IP address. These implicit IPs are subject
to change, not associated with a subscription, difficult to troubleshoot, and
do not follow Azure's model of "secure by default" which ensures
customers have strong security without additional steps needed. The
private subnet feature prevents this insecure implicit connectivity for any
newly created subnets by setting the "default outbound access"
parameter to false. You can then pick your preferred method for explicit
outbound connectivity, such as a NAT Gateway or Public IP address.
Additionally, please note that after
March 31, 2026, new virtual networks will default to using private subnets,
meaning that an explicit outbound method must be enabled in order to reach
public endpoints on the Internet and within Microsoft. Older versions of
the Azure API will not be affected, and there would also be no change to
existing virtual networks. This means that there will be no change in the operation of existing or new virtual machines in these subnets.