Hi there Of us!
If in case you have ever spent an extended afternoon untangling overlapping CIDR ranges, chasing down a damaged VNet peering, or making an attempt to recollect which UDR factors to which firewall, this MAIS 2026 session goes to really feel uncomfortably acquainted. Jon Ormond (Principal PM, Azure Networking) introduced alongside Jay Li and Jeff Lovett from the Azure Networking crew to stroll by what truly occurs when an Azure community grows from a handful of VNets into an actual enterprise property, and the place most groups hit the wall.
The headline they saved coming again to is easy. Azure networks don’t often fail as a result of they had been constructed mistaken on day one. They fail as a result of they didn’t evolve quick sufficient. Scale is just not a easy ramp. It’s a step perform, and each step provides an order of magnitude of complexity.
You could be working three VNets at the moment. That’s tremendous. However the day a second crew exhibits up, otherwise you cross right into a second area, or someone asks for hybrid connectivity to the datacenter, your working mannequin modifications whether or not you deliberate for it or not. The session is constructed round two pivots each rising Azure setting hits:
- Administration and management inside Azure (VNets, peerings, routes, safety guidelines).
- Connectivity and hybrid (VPN, ExpressRoute, Digital WAN, reliability).
Each of these break quietly. By the point you discover, you might be already firefighting drift, damaged peerings, or unpredictable latency from on-prem.
Backside line, here’s what you’re taking away:
- Design for the subsequent stage, not the one you might be in.
- Put the administration layer in earlier than complexity outpaces handbook effort.
- Deal with reliability as a design alternative, not an afterthought.
One VNet, one subnet, one workload. Nothing mistaken with that. You’ll be able to handle it with the portal, a spreadsheet for CIDR monitoring, and a peaceful coronary heart.
The issue is that the bounce from “one VNet” to “just a few VNets throughout groups” is just not gradual. As quickly as you have got a second crew that wants isolation, you might be into hub and spoke territory. Ten spokes feels manageable. Fifty spokes throughout a number of subscriptions doesn’t. And by the point you hit 100, the spreadsheet is a legal responsibility.
Jay made the case that the neatest transfer at small scale is to not keep handbook till it hurts. It’s to place Azure Digital Community Supervisor (AVNM) in early, even if you happen to solely have three VNets. AVNM enables you to declare intent as soon as and let the platform deal with the remaining:
- IP handle administration (IPAM) so new spokes get non-overlapping CIDRs robotically.
- Community teams with tag-based dynamic membership so VNets land in the precise group the second they exist.
- Connectivity (hub and spoke or mesh) with out hand-built peerings.
- Safety admin guidelines pushed centrally throughout the property.
- Routing intent so visitors flows by the precise firewall by default.
The trustworthy tradeoff: AVNM is another factor to be taught and function, and it provides value. The counter-question Jay saved asking is, “What’s the price of drift?” One overlapping CIDR or one lacking UDR at 100 VNets can cascade into an outage that takes days to unwind. That’s the actual tradeoff.
The hub and spoke topology is the workhorse of Azure networking and the sample the Cloud Adoption Framework recommends for many enterprises. It centralises shared companies (firewall, DNS, ExpressRoute and VPN gateways, Non-public DNS zones) in a hub VNet, and connects spoke VNets by peerings.
The place groups get into bother at this stage:
- Peering sprawl. Each new spoke wants a peering, typically two if you’d like transitive paths. Doing this by hand throughout subscriptions is the place human error lives.
- Route desk drift. UDRs copied from spoke to spoke get out of sync. One spoke routes by the firewall, one other bypasses it. Now you have got a compliance drawback.
- Safety rule drift. NSGs and safety insurance policies begin as a replica paste train and finish as a forensic train.
- CIDR collisions. “Simply give me a /24” turns right into a multi day investigation when the brand new spoke overlaps with on-prem.
Jay’s level on this was sharp. The error is just not the topology. Hub and spoke is the precise sample. The error is staying handbook on high of it. AVNM community teams allow you to say, “any VNet tagged setting=manufacturing joins the manufacturing group, will get the manufacturing safety baseline, friends to the manufacturing hub, and inherits the routing intent that sends east-west visitors by the firewall.” No tickets, no copy paste, no drift.
In case you are already deployed by way of Azure Touchdown Zones (ALZ) with Bicep or Terraform, AVNM is just not a alternative, it’s one other assemble in your template. As Jon put it within the chat, it’s “simply one other object” in your ALZ, and the 2 layers work collectively quite than competing.
Sooner or later hub and spoke stops scaling cleanly. You begin including areas. Department places of work present up. You want SD-WAN integration, greater than 30 IPsec tunnels, or transitive routing between VPN and ExpressRoute. That’s when Microsoft pushes you towards Azure Digital WAN.
Digital WAN is a Microsoft managed international transit community. You deploy regional digital hubs and join all the things (Azure VNets, branches, distant customers, ExpressRoute circuits) into them with constant routing and safety. The commerce up is actual:
- Any to any connectivity by default. Hub to hub mesh is inbuilt.
- Routing intent and insurance policies for centralised web egress and east-west inspection by Azure Firewall or a companion NVA in a secured hub.
- Department scale. Tens or lots of of web sites cease being a customized integration undertaking.
- Operational simplification. Microsoft owns the hub management airplane so that you cease babysitting peerings.
For hybrid connectivity itself, Jeff walked the curve each buyer travels:
- VPN Gateway is the on-ramp. Low cost, quick to face up, ok till public web latency, throughput, or regulatory necessities drive a change.
- ExpressRoute circuits provide you with devoted bandwidth from 50 Mbps to 100+ Gbps, with predictable efficiency and over 200 service suppliers worldwide.
- Scalable ExpressRoute digital community gateways develop and shrink with utilization, so that you deploy as soon as and cease re-architecting each time visitors modifications.
- ExpressRoute Metro is the headliner. Similar value as a normal circuit, however the redundant machine lives in a second, bodily distinct co-location facility throughout city. Constructing fireplace, flood, or energy outage in a single website, and your visitors retains flowing.
- A number of circuits are nonetheless on the desk when “this can not fail” truly means it can not fail.
Trustworthy tradeoff on Digital WAN: it’s opinionated, Microsoft managed, and also you quit a few of the granular management you have got in a buyer managed hub. For many enterprises that could be a win. For the few with very particular routing necessities or heavy NVA investments, conventional hub and spoke with Azure Route Server can nonetheless be the precise name. The CAF steerage lays this out intimately.
When you take one factor from this session, take this. Design for the subsequent stage. Three concrete strikes:
- Rise up AVNM now, even at small scale. Declare your intent for IPAM, connectivity, safety, and routing as soon as. Let new VNets inherit it.
- Choose your topology with eyes open. Hub and spoke for buyer managed management, Digital WAN for Microsoft managed international transit at scale. The CAF determination tree is the precise start line.
- Plan hybrid for failure, not for the sunny day. ExpressRoute with Metro by default. A number of circuits for the workloads that genuinely can not go down. Take a look at the failover.
This was certainly one of many nice classes on the Microsoft Azure Infra Summit 2026. If you wish to catch the keynotes, the deep dives on storage and AKS, and all the things in between, the total playlist is right here:
Microsoft Azure Infra Summit 2026 Playlist
Huge due to Jon Ormond for moderating, and to Jay Li and Jeff Lovett for the sensible, no-fluff stroll by what truly breaks at scale and methods to design forward of it.
Cheers!
Pierre Roman
