Whats up People!
In case you have ever spent an extended afternoon untangling overlapping CIDR ranges, chasing down a damaged VNet peering, or making an attempt to recollect which UDR factors to which firewall, this MAIS 2026 session goes to really feel uncomfortably acquainted. Jon Ormond (Principal PM, Azure Networking) introduced alongside Jay Li and Jeff Lovett from the Azure Networking staff to stroll by way of what really occurs when an Azure community grows from a handful of VNets into an actual enterprise property, and the place most groups hit the wall.
The headline they stored coming again to is easy. Azure networks don’t often fail as a result of they had been constructed flawed on day one. They fail as a result of they didn’t evolve quick sufficient. Scale just isn’t a clean ramp. It’s a step perform, and each step provides an order of magnitude of complexity.
Chances are you’ll be operating three VNets at the moment. That’s advantageous. However the day a second staff exhibits up, otherwise you cross right into a second area, or any person asks for hybrid connectivity to the datacenter, your working mannequin adjustments whether or not you deliberate for it or not. The session is constructed round two pivots each rising Azure surroundings hits:
- Administration and management inside Azure (VNets, peerings, routes, safety guidelines).
- Connectivity and hybrid (VPN, ExpressRoute, Digital WAN, reliability).
Each of these break quietly. By the point you discover, you might be already firefighting drift, damaged peerings, or unpredictable latency from on-prem.
Backside line, here’s what you are taking away:
- Design for the following stage, not the one you might be in.
- Put the administration layer in earlier than complexity outpaces guide effort.
- Deal with reliability as a design selection, not an afterthought.
One VNet, one subnet, one workload. Nothing flawed with that. You possibly can handle it with the portal, a spreadsheet for CIDR monitoring, and a relaxed coronary heart.
The issue is that the soar from “one VNet” to “a number of VNets throughout groups” just isn’t gradual. As quickly as you have got a second staff that wants isolation, you might be into hub and spoke territory. Ten spokes feels manageable. Fifty spokes throughout a number of subscriptions doesn’t. And by the point you hit 100, the spreadsheet is a legal responsibility.
Jay made the case that the neatest transfer at small scale is to not keep guide till it hurts. It’s to place Azure Digital Community Supervisor (AVNM) in early, even should you solely have three VNets. AVNM allows you to declare intent as soon as and let the platform deal with the remaining:
- IP deal with administration (IPAM) so new spokes get non-overlapping CIDRs routinely.
- Community teams with tag-based dynamic membership so VNets land in the correct group the second they exist.
- Connectivity (hub and spoke or mesh) with out hand-built peerings.
- Safety admin guidelines pushed centrally throughout the property.
- Routing intent so visitors flows by way of the correct firewall by default.
The trustworthy tradeoff: AVNM is yet another factor to be taught and function, and it provides price. The counter-question Jay stored asking is, “What’s the price of drift?” One overlapping CIDR or one lacking UDR at 100 VNets can cascade into an outage that takes days to unwind. That’s the actual tradeoff.
The hub and spoke topology is the workhorse of Azure networking and the sample the Cloud Adoption Framework recommends for many enterprises. It centralises shared companies (firewall, DNS, ExpressRoute and VPN gateways, Non-public DNS zones) in a hub VNet, and connects spoke VNets by way of peerings.
The place groups get into bother at this stage:
- Peering sprawl. Each new spoke wants a peering, generally two if you would like transitive paths. Doing this by hand throughout subscriptions is the place human error lives.
- Route desk drift. UDRs copied from spoke to spoke get out of sync. One spoke routes by way of the firewall, one other bypasses it. Now you have got a compliance downside.
- Safety rule drift. NSGs and safety insurance policies begin as a duplicate paste train and finish as a forensic train.
- CIDR collisions. “Simply give me a /24” turns right into a multi day investigation when the brand new spoke overlaps with on-prem.
Jay’s level on this was sharp. The error just isn’t the topology. Hub and spoke is the correct sample. The error is staying guide on prime of it. AVNM community teams allow you to say, “any VNet tagged surroundings=manufacturing joins the manufacturing group, will get the manufacturing safety baseline, friends to the manufacturing hub, and inherits the routing intent that sends east-west visitors by way of the firewall.” No tickets, no copy paste, no drift.
If you’re already deployed by way of Azure Touchdown Zones (ALZ) with Bicep or Terraform, AVNM just isn’t a substitute, it’s one other assemble in your template. As Jon put it within the chat, it’s “simply one other object” in your ALZ, and the 2 layers work collectively quite than competing.
Sooner or later hub and spoke stops scaling cleanly. You begin including areas. Department workplaces present up. You want SD-WAN integration, greater than 30 IPsec tunnels, or transitive routing between VPN and ExpressRoute. That’s when Microsoft pushes you towards Azure Digital WAN.
Digital WAN is a Microsoft managed world transit community. You deploy regional digital hubs and join every thing (Azure VNets, branches, distant customers, ExpressRoute circuits) into them with constant routing and safety. The commerce up is actual:
- Any to any connectivity by default. Hub to hub mesh is in-built.
- Routing intent and insurance policies for centralised web egress and east-west inspection by way of Azure Firewall or a companion NVA in a secured hub.
- Department scale. Tens or a whole bunch of web sites cease being a customized integration venture.
- Operational simplification. Microsoft owns the hub management airplane so that you cease babysitting peerings.
For hybrid connectivity itself, Jeff walked the curve each buyer travels:
- VPN Gateway is the on-ramp. Low-cost, quick to face up, ok till public web latency, throughput, or regulatory necessities drive a change.
- ExpressRoute circuits offer you devoted bandwidth from 50 Mbps to 100+ Gbps, with predictable efficiency and over 200 service suppliers worldwide.
- Scalable ExpressRoute digital community gateways develop and shrink with utilization, so that you deploy as soon as and cease re-architecting each time visitors adjustments.
- ExpressRoute Metro is the headliner. Similar worth as an ordinary circuit, however the redundant machine lives in a second, bodily distinct co-location facility throughout city. Constructing fireplace, flood, or energy outage in a single website, and your visitors retains flowing.
- A number of circuits are nonetheless on the desk when “this can not fail” really means it can not fail.
Sincere tradeoff on Digital WAN: it’s opinionated, Microsoft managed, and also you surrender among the granular management you have got in a buyer managed hub. For many enterprises that may be a win. For the few with very particular routing necessities or heavy NVA investments, conventional hub and spoke with Azure Route Server can nonetheless be the correct name. The CAF steerage lays this out intimately.
In case you take one factor from this session, take this. Design for the following stage. Three concrete strikes:
- Get up AVNM now, even at small scale. Declare your intent for IPAM, connectivity, safety, and routing as soon as. Let new VNets inherit it.
- Decide your topology with eyes open. Hub and spoke for buyer managed management, Digital WAN for Microsoft managed world transit at scale. The CAF resolution tree is the correct start line.
- Plan hybrid for failure, not for the sunny day. ExpressRoute with Metro by default. A number of circuits for the workloads that genuinely can not go down. Check the failover.
This was certainly one of many nice classes on the Microsoft Azure Infra Summit 2026. If you wish to catch the keynotes, the deep dives on storage and AKS, and every thing in between, the total playlist is right here:
Microsoft Azure Infra Summit 2026 Playlist
Massive due to Jon Ormond for moderating, and to Jay Li and Jeff Lovett for the sensible, no-fluff stroll by way of what really breaks at scale and the way to design forward of it.
Cheers!
Pierre Roman
