Private subnets by default in Azure Virtual Networks: What changed and how to use NAT Gateway

Azure is evolving to better support secure ‑ by ‑ default cloud architectures. Starting with API version 2025 ‑ 07 ‑ 01 (released after March 31, 2026) , newly created virtual networks now default to using private subnets . This change removes the long ‑ standing platform behavior of automatically enabling outbound internet access through implicit public IPs, also known as default outbound access (DOA) .