AzureFeeds

Azure will remove the default outbound connectivity effective September 30, 2025. Currently, any virtual machine (VM) deployed in Azure can access the Internet by default. This capability is provided via a publicly managed IP address and NAT configuration; users have no control over these settings; but no additional configuration is required. More details can be found in the official update on this page.

Initially, the announcement indicated that all VMs created after September 30, 2025, would lose the implicit Internet access. However, an update published on June 18, 2025, clarified that the change affects only new virtual networks (VNets). Only VNets created after the effective date will require explicit configuration for outbound connectivity. This configuration may involve provisioning a NAT gateway, firewall, load balancer with NAT rules, or a public IP address. Conversely, a VM connected to a VNet deployed before September 30, 2025, will remain unaffected.

It is important to note that this change does not apply universally to every VNet. According to a related announcement concerning private subnets, older versions of the Azure API will not be affected, and existing virtual networks will not undergo any changes. For further nuance, please refer to this page.

For users of Azure Bicep or ARM templates, it is helpful to understand that every deployment call interacts with a versioned Azure API. For example, the current API version for deploying virtual networks is 2024-07-01, although earlier versions, such as 2024-05-01 or 2024-01-01 and others, remain available. Each API version may include new properties or modifications to existing ones; additional details are available on the following pages

• VNET Template
• VNET change log

When defining a virtual network resource in Bicep or an ARM template, you must specify the API version, as shown in the example below:

Bicep

resource myVnet 'Microsoft.Network/virtualNetworks@2024-07-01'

ARM Templates

"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2024-07-01"

After September 30, 2025, a new API version will become available and will be used by default in the Azure Portal, PowerShell, and Azure CLI. However, if you explicitly specify the API version in your deployment scripts, your VM deployments will continue to use the default outbound connectivity.

For infrastructure-as-code (IaC) tools that do not allow for API version specification, this change is significant. For example, when using Terraform with the Azurerm provider, users are unable to select a specific API version and will automatically receive the latest version. To preserve the existing outbound connectivity behavior when using Terraform, it is recommended to utilize the azAPI provider instead.

For PowerShell and Azure CLI users, the API version in use will depend on the tool version. Once these tools have been updated, they will adopt the latest default API version and the corresponding outbound connectivity behavior.

This update shows the importance of explicitly specifying the API version in deployment scripts where possible, ensuring that your Azure resources behave as expected following the retirement of implicit outbound connectivity.