Cram sheet — Configure and manage virtual networks in Azure

Address space, peering, addressing and routing. Two of these have hard numbers worth memorising, and one has a retirement date that has already passed and still appears in stale study material.

Peering

• By default a virtual network peers with up to 500 other virtual networks, raised to 1,000 using Azure Virtual Network Manager's connectivity configuration.
• Gateway transit is a peering property that lets a network use a VPN or ExpressRoute gateway in its peer, and it works for both regional and global peering.
• ⚠ Traffic to a gateway in the peered network incurs peering charges on the spoke. The documentation explicitly corrects an earlier version of itself that said otherwise, so older study notes are wrong here.

Routing: system routes come first, and you cannot delete them

• Azure automatically creates a route table for each subnet and populates it with system routes.
• ⚠ You cannot create system routes and you cannot remove them — you can only override some of them with custom routes.
• Azure routes outbound traffic from a subnet based on that subnet's route table, which is why a routing fault is diagnosed at the subnet and not at the machine.

Public IP addresses

• ⚠ Basic SKU public IPs were retired on 30 September 2025. Standard is the answer; any option offering Basic is describing something that no longer exists.
• A resource without a public IP can still reach outward: Azure automatically assigns an available dynamic address for outbound communication, and that address is not dedicated and can change.
• That default is why "the VM has no public IP" never by itself explains a failed outbound connection — but always explains a failed inbound one.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.