Azure Networking

One architecture. Ten explainers.

This is the enterprise network almost every Azure workload ends up with. Ten short animations take it apart, one piece at a time — in the order you'd actually build it.

What you'll learn
  • Build it — virtual networks, subnets and NICs, plus a naming convention that survives a redesign.
  • Secure it — NSGs and ASGs, Azure Firewall and WAF, and private endpoints instead of public IPs.
  • Connect it — peering, Bastion, DNS, VPN and ExpressRoute, Virtual WAN, and load balancing.
  • Operate it — Network Watcher for right now, Azure Monitor for always.

By the end you can read this diagram — and draw your own.

Works toward Microsoft Certified: Azure Network Engineer Associate Exam AZ-700 — this journey covers the skills it measures

Study with the official AZ-700 learning path ↗ and the exam study guide ↗

Start with the virtual network →
Microsoft Azure Internet Public traffic On-premises VPN · ExpressRoute hub-vnet 10.10.0.0/16 AzureFirewallSubnet AzureBastionSubnet GatewaySubnet peering spoke-web 10.20.0.0/16 snet-agw snet-web spoke-data 10.30.0.0/16 snet-app snet-data
See the architecture
Microsoft Azure Microsoft Azure
From the internet
Users, worldwidePublic internet
04 DNS & Private LinkResolve the name · private endpoints 05 Load balancingFront Door · App Gateway · Load Balancer From your datacentre
On-premises & branchesOffices, remote users
07 VPN Gateway & ExpressRouteEncrypt the internet, or bypass it
Always sitting in front
Public IP addresses NAT Gateway
DDoS platform protection · always on
08 Azure Virtual WANOr a hub you run yourself The hub 06 WAF & Azure FirewallInspect it · and the routes to it 03 VNet peering & BastionPrivate reach · no public IPs

Every flow above crosses this hub — internet, on-premises and spoke-to-spoke.

Shared services in the hub
GatewaySubnet AzureFirewallSubnet
AzureBastionSubnet Route tables
Private DNS zones Log Analytics
RouteServerSubnet DNS Private Resolver
01 Virtual NetworkVNet · subnets · NICs The spokes — where the workload lives 02 NSG & ASGFilter by name, not by IP address

Each tier sits in its own subnet — the NSG guards the subnet, the ASG names the workload.

The rule it produces

Allow 1433 · TCP · from AsgApp to AsgDb

No IP addresses. Add a subnet, nothing changes.
The solution the network exists for
snet-agw App Gateway · its own subnet
snet-web App Service Container Apps
snet-app Virtual machines AKS
snet-data Private endpoint Azure SQL Cosmos DB Key Vault Storage
Across all of it 09 Network monitoringNetwork Watcher for now, Azure Monitor for always 10 Naming conventionNames that tell you what a resource is
Build Secure Connect Operate