title | titleSuffix | description | author | ms.author | ms.service | ms.subservice | ms.topic | ms.date |
---|---|---|---|---|---|---|---|---|
Default outbound access in Azure |
Azure Virtual Network |
Learn about default outbound access in Azure. |
mbender-ms |
mbender |
azure-virtual-network |
ip-services |
conceptual |
10/23/2024 |
In Azure, virtual machines created in a virtual network without explicit outbound connectivity defined are assigned a default outbound public IP address. This IP address enables outbound connectivity from the resources to the Internet. This access is referred to as default outbound access.
Examples of explicit outbound connectivity for virtual machines are:
-
Created within a subnet associated to a NAT gateway.
-
Deployed in the backend pool of a standard load balancer with outbound rules defined.
-
Deployed in the backend pool of a basic public load balancer.
-
Virtual machines with public IP addresses explicitly associated to them.
:::image type="content" source="./media/default-outbound-access/explicit-outbound-options.png" alt-text="Diagram of explicit outbound options.":::
The public IPv4 address used for the access is called the default outbound access IP. This IP is implicit and belongs to Microsoft. This IP address is subject to change and it's not recommended to depend on it for production workloads.
If you deploy a virtual machine in Azure and it doesn't have explicit outbound connectivity, it's assigned a default outbound access IP.
:::image type="content" source="./media/default-outbound-access/decision-tree-load-balancer-thumb.png" alt-text="Diagram of decision tree for default outbound access." lightbox="./media/default-outbound-access/decision-tree-load-balancer.png":::
Important
On September 30, 2025, default outbound access for new deployments will be retired. For more information, see the official announcement. We recommend that you use one of the explicit forms of connectivity discussed in the following section.
-
Secure by default
- It's not recommended to open a virtual network to the Internet by default using the Zero Trust network security principle.
-
Explicit vs. implicit
- It's recommended to have explicit methods of connectivity instead of implicit when granting access to resources in your virtual network.
-
Loss of IP address
- Customers don't own the default outbound access IP. This IP might change, and any dependency on it could cause issues in the future.
Some examples of configurations that won't work when using default outbound access:
- When you have multiple NICs on the same VM, default outbound IPs won't consistently be the same across all NICs.
- When scaling up/down Virtual Machine Scale sets, default outbound IPs assigned to individual instances can and change.
- Similarly, default outbound IPs aren't consistent or contiguous across VM instances in a Virtual Machine Scale Set.
How can I transition to an explicit method of public connectivity (and disable default outbound access)?
There are multiple ways to turn off default outbound access. The following sections describe the options available to you.
Important
Private Subnets are currently in public preview. This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see Supplemental Terms of Use for Microsoft Azure Previews.
-
Creating a subnet to be Private prevents any virtual machines on the subnet from utilizing default outbound access to connect to public endpoints.
-
VMs on a Private subnet can still access the Internet using explicit outbound connectivity.
[!NOTE] Certain services won't function on a virtual machine in a Private Subnet without an explicit method of egress (examples are Windows Activation and Windows Updates).
- From the Azure portal, ensure the option to enable Private subnet is selected as part of the Virtual Network subnet create/modify experience as shown below:
:::image type="content" source="./media/default-outbound-access/private-subnet-portal.png" alt-text="Screenshot of Azure portal showing Private subnet option.":::
-
Using PowerShell, when creating a subnet with New-AzVirtualNetworkSubnetConfig, use the
DefaultOutboundAccess
option and choose "$false". After creation, a subnet can be set using Set-AzVirtualNetworkSubnetConfig. -
Using CLI, when creating a subnet with az network vnet subnet create, use the
--default-outbound
option and choose "false". After creation, a subnet can be set using az network vnet subnet update. -
Using an Azure Resource Manager template, set the value of
defaultOutboundAccess
parameter to be "false".
-
In order to utilize to activate/update virtual machine operation systems, including Windows, it's a requirement to have an explicit outbound connectivity method.
-
In configurations using a User Defined Route (UDR) with a default route (0/0) that sends traffic to an upstream firewall/network virtual appliance, any traffic that bypasses this route (for example, to Service Tagged destinations) breaks in a Private subnet.
-
Associate a NAT gateway to the subnet of your virtual machine.
-
Associate a standard load balancer configured with outbound rules.
-
Associate a Standard public IP to any of the virtual machine's network interfaces (if there are multiple network interfaces, having a single NIC with a standard public IP prevents default outbound access for the virtual machine).
- Flexible scale sets are secure by default. Any instances created via Flexible scale sets don't have the default outbound access IP associated with them, so an explicit outbound method is required. For more information, see Flexible orchestration mode for Virtual Machine Scale Sets
Important
When a load balancer backend pool is configured by IP address, it will use default outbound access due to an ongoing known issue. For secure by default configuration and applications with demanding outbound needs, associate a NAT gateway to the VMs in your load balancer's backend pool to secure traffic. See more on existing known issues.
NAT gateway is the recommended approach to have explicit outbound connectivity. A firewall can also be used to provide this access.
-
Default outbound access IP doesn't support fragmented packets.
-
Default outbound access IP doesn't support ICMP pings.
For more information on outbound connections in Azure and Azure NAT Gateway, see: