This chapter covers Azure Virtual Networks (VNets), the foundational networking building block in Azure. AZ-900 tests this under objective 2.3, "Describe Azure networking services."
Jump to a section
A simple way to picture Azure Virtual Networks (VNet)
Imagine a company's internal office network — computers, printers, and servers all connected privately, able to communicate with each other directly, with controlled gateways for anything going out to the public internet. An Azure Virtual Network works the same way: it's a private, isolated network within Azure where resources can communicate with each other securely, with controlled boundaries for what can come in from — or go out to — the internet or other networks.
What a Virtual Network is
An Azure Virtual Network (VNet) is a private, isolated network within Azure where resources — like virtual machines — can communicate with each other, with the internet, and with on-premises networks, under controlled, configurable rules.
How it works
A VNet is divided into subnets, smaller segments used to organize resources and apply different rules to different parts of the network. Resources within a VNet (or connected VNets) can communicate with each other privately, while access to and from the internet or other networks is controlled through configuration.
Key concepts
Subnets: subdivisions of a VNet, used to organize and segment resources.
Private IP addressing: resources within a VNet typically communicate using private IP addresses, not directly exposed to the internet unless specifically configured.
VNet peering: connecting two VNets so resources in each can communicate, covered in more detail in its own chapter.
Network security groups: rules controlling what traffic is allowed in and out of subnets or individual resources, covered in a dedicated chapter.
Why VNets matter
Without a VNet, resources would have no private, controlled way to communicate with each other — everything would depend on public internet connectivity with less isolation and control. VNets give organizations the isolation and control they'd expect from a traditional on-premises network, while still running in Azure's cloud infrastructure.
Create a Virtual Network
A VNet is created within a region, defining the private address space that resources within it will use.
Divide it into subnets
The VNet is divided into subnets to organize resources and allow different rules to be applied to different segments.
Connect resources to the VNet
Resources like virtual machines are connected to a specific subnet within the VNet, giving them private connectivity to other resources in the same network.
Control traffic in and out
Network security groups and other controls determine what traffic is allowed to and from the VNet, its subnets, or individual resources.
A company deploys its web application's front-end servers in one subnet and its database servers in another subnet within the same VNet, applying stricter access rules to the database subnet so only the front-end servers can reach it directly, rather than exposing the database more broadly.
A separate organization connects its on-premises network to an Azure VNet, extending its private network into Azure so on-premises and cloud resources can communicate securely — a hybrid networking scenario that depends on VNets as the foundational building block on the Azure side.
Objective 2.3 expects candidates to understand what a Virtual Network is and its role as the foundational networking construct in Azure, connecting to other networking topics like subnets, peering, and network security groups covered in their own chapters.
A common wrong answer is assuming resources in a VNet are automatically exposed to the internet — by default, communication within a VNet is private, and exposure to the internet requires specific configuration. Another common trap is confusing subnets with separate VNets — subnets are subdivisions *within* a single VNet, not separate networks.
Stable terms: Virtual Network (VNet), subnet, private IP address. Understanding VNets as the private, foundational networking layer in Azure ties directly into several other networking chapters.
Memory trick: a VNet is your own private network space in Azure — resources inside it can talk to each other privately by default, and anything going further (to the internet or another network) requires deliberate configuration.
An Azure Virtual Network (VNet) is a private, isolated network within Azure for resources to communicate securely.
VNets are divided into subnets, used to organize resources and apply different rules to different segments.
By default, communication within a VNet is private — exposure to the internet requires specific configuration.
VNets can connect to on-premises networks and to other VNets, not just contain resources entirely within Azure.
These come up on the exam all the time. Here's how to tell them apart.
Virtual Network (VNet)
The overall private network space in Azure
Defines the address range for its resources
Can be divided into multiple subnets
Subnet
A subdivision within a single VNet
Used to organize and segment resources
Can have its own specific rules applied
Mistake
Resources in a Virtual Network are automatically exposed to the internet.
Correct
By default, communication within a VNet is private. Exposing a resource to the internet requires specific configuration, not automatic exposure.
Mistake
A subnet is a separate network from its Virtual Network.
Correct
A subnet is a subdivision *within* a single Virtual Network, used to organize resources and apply different rules to different segments — not a separate, independent network.
Mistake
Virtual Networks can only be used entirely within Azure.
Correct
VNets can also connect to on-premises networks (via VPN Gateway or ExpressRoute, covered in a separate chapter) and to other VNets (via peering), not just resources entirely within Azure.
It's a private, isolated network within Azure where resources — like virtual machines — can communicate with each other, the internet, and on-premises networks, under configurable, controlled rules.
A VNet is the overall private network space; a subnet is a subdivision within that VNet, used to organize resources and apply different rules to different segments. A VNet can contain multiple subnets.
No — by default, communication within a VNet is private. Exposing a specific resource to the internet requires deliberate configuration, not something that happens automatically just by placing a resource in a VNet.
You've just covered Azure Virtual Networks (VNet) — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?