Azure hub — Networking family (2026-10-20)

What the Networking family adds — references for VNets, subnets and peering, outbound connectivity, NSGs and routes, and private endpoints with private DNS; error catalogues for networking, Application Gateway and WAF, Front Door and Load Balancer; a connectivity diagnosis guide; and a private endpoint pattern in Bicep — with the 2026 changes it captures, how it was verified and what is missing.

markdownreferencev1KJHT-HD6Qarea: changelogchangelogrelease notesnetworking family

Created 21 Oct 2026 · Modified 23 Oct 2026 · 1 version

What's in it

11 documents including this note, bringing the hub to 72:

  • References: reference/networking/vnets-subnets-and-peering.md, reference/networking/outbound-connectivity.md, reference/networking/nsgs-and-routes.md, reference/networking/private-endpoints-and-dns.md.
  • Error catalogues: reference/networking/errors.md (subnets, delegation, peering, private endpoints, DNS, deletion), reference/application-gateway/errors.md, reference/front-door/errors.md, reference/load-balancer/errors.md.
  • Guide: diagnosing a connection that times out or is refused, step by step with Network Watcher.
  • Pattern: a private endpoint for a PaaS service, with its DNS zone, link and zone group, in Bicep.

2026 changes captured

  • Private subnets by default: subnets in new virtual networks created with network API versions released after March 31, 2026 have defaultOutboundAccess: false; existing networks don't change. The REST spec states no default, so templates set it explicitly. The Compute documents were corrected to say "API versions released after", not "created after".
  • NAT gateway StandardV2 (zone-redundant, StandardV2 public IPs only, no upgrade path from Standard).
  • Retired: Basic public IPs and Basic Load Balancer (September 30, 2025), Application Gateway v1 (April 28, 2026), TLS 1.0/1.1 on Application Gateway (2025). Retiring: Front Door (classic) on March 31, 2027; NSG flow logs on September 30, 2027 (no new ones; use virtual network flow logs).
  • Private DNS links have resolutionPolicy: NxDomainRedirect for privatelink zones (fallback to public resolution).
  • Connection troubleshoot without the Network Watcher VM extension is in preview.

How it was verified

  • Sources were read from azure-docs@dd032389 (virtual network, private link, DNS, NAT gateway, Load Balancer, Application Gateway, Front Door, Network Watcher, Bastion, Firewall and VPN Gateway pages), SupportArticles-docs@ff674f85 (troubleshooting articles for all of these) and azure-rest-api-specs@c783b658 (Network 2026-01-01 and 2026-03-01, Private DNS 2024-06-01).
  • The Bicep pattern compiles and lints clean with Bicep 0.48.1 (Network 2026-01-01 is the newest with types). Every az command was checked against Azure CLI 2.91.0 help.

Corrections made while checking

  • Front Door doesn't stop serving when every origin fails its probe: it round-robins across all of them.
  • Load Balancer HTTP probes fail on anything but 200, immediately.
  • Microsoft's private endpoint 403 article lists Client address is not authorized and caller is not a trusted service under Storage; it's Key Vault's firewall message elsewhere.

Known gaps

  • VPN Gateway, ExpressRoute, Virtual WAN, Azure Firewall policy, Azure Virtual Network Manager and DDoS Protection aren't covered beyond subnet requirements.
  • Network Watcher packet capture and flow log analysis are left to the observability family.

Read this document as markdown — the same bytes an agent receives.