Secure Azure VMs with Private Subnets: A Step-by-Step Guide

In this video, we dive into Azure's new Private Subnets virtual network feature, which brings greater security and control to your Azure VMs. Starting in September 2025, Microsoft will disable default internet access for Azure VMs, impacting organizations relying on direct outbound internet connections. Please join me as we walk through how Private Subnets enable explicit internet configuration, reducing security risks by ensuring VMs don’t bypass organizational firewalls and content filters without authorization.

Follow along as we create a private subnet on an Azure VNet in the Azure Portal, move a VM into it, and test internet connectivity to see firsthand how the feature restricts access without a defined NAT gateway or other route. Perfect for Azure admins and cloud architects, this tutorial ensures you're prepared for upcoming changes and better VM security in Azure.

00:00 - Start
02:13 - Default Outbound Access
03:20 - Add a Private Subnet
03:51 - Change a VM Subnet
04:34 - No Default Outbound Access

Links
Free Azure guide! Subscribe to the newsletter

Zero to Hero with Azure Virtual Desktop

Hybrid Identity with Windows AD and Azure AD

Windows 365 Enterprise and Intune Management

Default Internet Access Announcement

Default Internet Access Video

[rs-tarxvfz]

Question what exactly is the mechanism how the private subnet denies or has no route to internet? Is there a way to understand this or is this implicitly managed by the azure?