--- cuppy_hub: azure cuppy_path: changelog/2026-10-20-networking-family.md cuppy_section: docs cuppy_doc: KJHT-HD6Q cuppy_doc_uuid: d8c98d70-49db-4256-b16c-81d40830ac37 cuppy_permalink: https://cuppy.io/azure/d/KJHT-HD6Q cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/changelog/2026-10-20-networking-family cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: f095e16974ed54a80326d9a30169d82adeb2c6d825c5184f6062d74bd7cb8f92 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Azure hub — Networking family (2026-10-20) ## What's in it 11 documents including this note, bringing the hub to 72: - **References:** `reference/networking/vnets-subnets-and-peering.md`, `reference/networking/outbound-connectivity.md`, `reference/networking/nsgs-and-routes.md`, `reference/networking/private-endpoints-and-dns.md`. - **Error catalogues:** `reference/networking/errors.md` (subnets, delegation, peering, private endpoints, DNS, deletion), `reference/application-gateway/errors.md`, `reference/front-door/errors.md`, `reference/load-balancer/errors.md`. - **Guide:** diagnosing a connection that times out or is refused, step by step with Network Watcher. - **Pattern:** a private endpoint for a PaaS service, with its DNS zone, link and zone group, in Bicep. ## 2026 changes captured - **Private subnets by default:** subnets in new virtual networks created with network API versions released after March 31, 2026 have `defaultOutboundAccess: false`; existing networks don't change. The REST spec states no default, so templates set it explicitly. The Compute documents were corrected to say "API versions released after", not "created after". - **NAT gateway StandardV2** (zone-redundant, StandardV2 public IPs only, no upgrade path from Standard). - **Retired:** Basic public IPs and Basic Load Balancer (September 30, 2025), Application Gateway v1 (April 28, 2026), TLS 1.0/1.1 on Application Gateway (2025). **Retiring:** Front Door (classic) on March 31, 2027; NSG flow logs on September 30, 2027 (no new ones; use virtual network flow logs). - **Private DNS links** have `resolutionPolicy: NxDomainRedirect` for privatelink zones (fallback to public resolution). - **Connection troubleshoot** without the Network Watcher VM extension is in preview. ## How it was verified - Sources were read from `azure-docs@dd032389` (virtual network, private link, DNS, NAT gateway, Load Balancer, Application Gateway, Front Door, Network Watcher, Bastion, Firewall and VPN Gateway pages), `SupportArticles-docs@ff674f85` (troubleshooting articles for all of these) and `azure-rest-api-specs@c783b658` (Network 2026-01-01 and 2026-03-01, Private DNS 2024-06-01). - The Bicep pattern compiles and lints clean with Bicep 0.48.1 (Network 2026-01-01 is the newest with types). Every `az` command was checked against Azure CLI 2.91.0 help. ## Corrections made while checking - Front Door doesn't stop serving when every origin fails its probe: it round-robins across all of them. - Load Balancer HTTP probes fail on anything but 200, immediately. - Microsoft's private endpoint 403 article lists `Client address is not authorized and caller is not a trusted service` under Storage; it's Key Vault's firewall message elsewhere. ## Known gaps - VPN Gateway, ExpressRoute, Virtual WAN, Azure Firewall policy, Azure Virtual Network Manager and DDoS Protection aren't covered beyond subnet requirements. - Network Watcher packet capture and flow log analysis are left to the observability family. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.