Plan Your IP Range and Subnets¶
When you request a spoke, you state how big your network must be. The platform team allocates the actual range from the central IP plan, so that ranges never overlap, which is required for hub routing. Ranges are private: they can't be reached from the internet.
Sizes¶
Azure reserves 5 addresses per subnet (the first four and the last). The usable count is therefore the total minus 5.
| CIDR | Total addresses | Usable in one subnet |
|---|---|---|
/28 |
16 | 11 |
/27 |
32 | 27 |
/26 |
64 | 59 |
/25 |
128 | 123 |
/24 |
256 | 251 |
Many Azure services use several addresses for availability and scaling (App Service integration, AKS nodes, private endpoints, Application Gateway). Check the Microsoft Learn page of each service for the minimum subnet size and delegation, and plan some room for growth.
Start with room to grow
A /24 is a common default for one spoke. If you need more, say so in your request: a larger range is easier to
allocate at the start than to add later. Within the range, don't use all addresses at once. Leave room for new
subnets, because a subnet that holds resources can't be resized.
Subnets¶
You can split your VNet into subnets to apply separate NSGs and routes, for example one for databases and one for web. In the MCP spoke JSON:
- Each network needs at least one private-link subnet (
isprivatelinksubnet: true) for private endpoints. The spoke Key Vault and storage account use the first one. - Add delegations and service endpoints per subnet (Spoke JSON).
- Subnets that already hold resources can't be resized. Add a new subnet instead.
Defaults differ per platform
Some platforms always create two standard subnets (for example a default and a private-endpoints subnet). MCP creates the subnets listed in your request. Name them the way your platform team asks.
Example¶
A /26 VNet (10.97.0.0 to 10.97.0.63) split in four /28 subnets:
| Subnet | CIDR | Addresses |
|---|---|---|
snet-default |
/28 |
10.97.0.0 to 10.97.0.15 |
snet-privatelink |
/28 |
10.97.0.16 to 10.97.0.31 |
snet-app |
/28 |
10.97.0.32 to 10.97.0.47 |
snet-data |
/28 |
10.97.0.48 to 10.97.0.63 |
Subnets with special requirements¶
Some services need a subnet of their own, with a minimum size and a delegation. Check the Microsoft Learn page of the
service before you plan the range. One example from a customer platform: the v2 tiers of API Management with virtual
network integration need a dedicated subnet that no other resource shares, at least a /27 (a /24 leaves room to
scale), delegated to Microsoft.Web/serverFarms, with an NSG attached. Ask your platform team whether this applies to
the service tier you use.
Network security groups on your subnets¶
Every subnet gets an NSG. When you ask for NSG changes, don't change the priority of an existing rule. Ask for a new rule with a new name instead. See How to change.
Growing later¶
If you need more addresses later, the platform team may give you an extra address space or a new VNet, because the adjacent range may already be in use. That works fine, but ranges are no longer contiguous.
Tools¶
- Azure virtual network best practices
- Any subnet calculator, for example CIDR.xyz or IPcalc.
What happens to the range when a spoke is deleted¶
The range stays reserved in the central IP plan until the platform team releases it. When you delete a spoke, the platform team also releases the range so it can be used again. See Delete a spoke.
See also: How to request a new spoke, How to change a spoke.