---
cuppy_hub: azure
cuppy_path: reference/networking/virtual-wan-and-network-manager.md
cuppy_section: docs
cuppy_doc: 6XK4-42N8
cuppy_doc_uuid: 31da6fa1-b8f9-40fd-a35d-507f621a4625
cuppy_permalink: https://cuppy.io/azure/d/6XK4-42N8
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/reference/networking/virtual-wan-and-network-manager
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: ddf4fe1cfb1f9c21864a38bc9d9ba12e21e52ee61f9b5b50cbdadc1519856405
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Hub-and-spoke at scale

Hand-built hubs (peering, UDRs, a firewall: `reference/networking/vnets-subnets-and-peering.md`) work for a few VNets. Past that, Microsoft offers a managed hub (**Virtual WAN**) and a manager for your own hubs (**Virtual Network Manager**). The hub's reading: pick Virtual WAN when branches, VPN and ExpressRoute dominate; pick Virtual Network Manager when you keep your own hub VNets and want policy-driven peering, security rules and routes across many subscriptions.

## Virtual WAN

| Type | Hubs can do |
|---|---|
| **Basic** | Site-to-site VPN only; no gateway scale units |
| **Standard** | ExpressRoute, point-to-site, site-to-site, **transit** between VNets and between hubs (each hub has a router; Standard hubs are full mesh), Azure Firewall, NVAs |

- Basic upgrades to Standard (delete any existing hub routes first); there is no way back.
- A hub's address space is **at least /24**; Microsoft advises **/23 or larger** at creation. It mustn't overlap connected VNets or branches.
- **Routing intent:** at most one **Internet** and one **Private** routing policy per hub, each with a single next hop (Azure Firewall, an NVA or a SaaS security solution in the hub). The internet policy advertises 0.0.0.0/0 to every spoke, gateway and NVA; the private policy sends all branch, VNet and inter-hub traffic through the next hop. A hub with Azure Firewall or a security NVA is a **secured hub**.
- DDoS Protection plans don't cover Virtual WAN (`reference/networking/firewall-and-ddos.md`).

## Azure Virtual Network Manager

- **Scope:** management groups and/or subscriptions the manager may configure. Above 15,000 subscriptions, Microsoft's policy integration works at subscription and resource group scopes only.
- **Network groups:** global sets of VNets, joined **statically** (you pick them) or **dynamically** (an Azure Policy definition and assignment add matching VNets). Cross-tenant VNets join only statically. A VNet can be in many groups.
- **Connectivity configurations:** **hub-and-spoke** (peerings to a hub VNet, optionally using its gateway) or **mesh** (a *connected group*, a construct of its own rather than peerings, where every member reaches every other directly; overlapping members' traffic is dropped). With *delete existing peerings* on, the manager removes peerings that don't match the configuration, including hand-made ones.
- **Security admin rules** apply to VNets and are **evaluated before NSGs**. `Allow` hands the flow on to NSGs; **`Always Allow`** and **`Deny`** stop evaluation, so an NSG can't override them. Use them for organisation-wide guardrails, and leave application rules to NSGs.
- **Routing configurations** create and maintain UDRs on target groups' subnets from route rules (for example, send spokes to a firewall). **IPAM** pools hand out non-overlapping CIDRs and track reservations.
- **Nothing takes effect until you deploy it** to chosen regions. Only **one security admin configuration and one routing configuration per region** can be deployed from a manager at a time (put more rules in more rule collections); several connectivity configurations can coexist. A VNet that joins a group later gets the group's already-deployed configurations automatically in that region (static members at once, Policy-added members after minutes or longer at large scale).


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->