AZ-104 Deep Dive: The Ultimate Guide to Implementing and Managing Azure Virtual Networking (2026)

Welcome to the definitive guide for mastering the “Implement and manage virtual networking” section of the Microsoft Azure Administrator (AZ-104) exam. As a seasoned Azure instructor who has guided thousands of professionals to certification success, I can tell you with certainty: networking is the backbone of Azure. A weak understanding here doesn’t just cost you exam points; it leads to insecure, inefficient, and costly cloud architectures in the real world.

This guide is engineered to bridge the gap between theoretical knowledge and practical application. We will move beyond simple definitions and dive into architectural analysis, real-world scenarios, common pitfalls, and the latest best practices for 2026. By the end of this deep dive, you will not only be prepared to answer any networking question the AZ-104 exam throws at you but also be equipped to design and manage robust virtual networks in production environments.

Let’s build your Azure networking expertise, one concept at a time.

Core Concepts: Building Your Azure Network Foundation

Every robust Azure environment is built upon a solid network foundation. Understanding Virtual Networks (VNets), IP addressing, and subnetting is non-negotiable.

Understanding Azure Virtual Networks (VNets)

An Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. It is a logically isolated representation of your own network in the cloud, enabling Azure resources like Virtual Machines (VMs) to securely communicate with each other, the internet, and your on-premises networks.

Think of it like this: A VNet is your private, fenced-off piece of land in the massive Azure cloud. Inside this land, you can build different houses (subnets) and decide who can enter or leave (security rules).

To dive deeper into Azure networking concepts, you can explore the following resources:

• AZ-104 Study Plan: A Complete Guide: For a comprehensive plan to pass the AZ-104 exam.
• AZ-104 vs AZ-204: Which Certification to Choose?: A guide to understanding the differences between the AZ-104 and AZ-204 certifications.

Key Characteristics of a VNet:

• Scoped to a Single Region: A VNet cannot span multiple Azure regions. To connect VNets in different regions, you must use VNet peering or a VPN gateway.
• Defined by an Address Space: You must define a private IP address space for your VNet using CIDR (Classless Inter-Domain Routing) notation (e.g., 10.0.0.0/16). It’s a best practice to use address ranges specified in RFC 1918.
• Can be Segmented into Subnets: Every VNet can be broken down into one or more subnets, which we’ll discuss next.

An Azure Virtual Network (VNet) is a logically isolated section of the Azure cloud where you can launch Azure resources in a private network that you define and control. It provides isolation, security, and connectivity for your cloud applications.

Mastering IP Addressing and Subnetting

Proper IP addressing and subnetting are critical for network scalability, organization, and security. When you’re working with IP Addressing and Subnetting, understanding Azure certification paths can guide your learning and help you understand the context:

• AZ-900 vs AZ-104: Understanding the Differences: An article to help you compare the AZ-900 and AZ-104 exams.
• Azure Certification Path: A full guide to the various Azure certifications, including AZ-104.

IP Addressing

Azure supports both IPv4 and IPv6. For the AZ-104 exam, the primary focus is on IPv4. Resources within a VNet are assigned a private IP address from the VNet’s address space. Some resources, like load balancers and VMs, can also have a public IP address assigned to them, making them accessible from the internet.

• Private IP Addresses: Used for communication within a VNet and with on-premises networks. They are assigned dynamically by default, but you can set them to be static.
• Public IP Addresses: Used for communication with the internet. They can be associated with VMs, load balancers, VPN gateways, and other resources. They come in two SKUs:
  • Basic: Free, but lacks features like availability zone resilience. Being phased out.
  • Standard: Recommended for production. Secure by default (closed to inbound traffic unless explicitly allowed) and zone-redundant.

Subnetting

Subnetting is the practice of dividing a VNet into smaller network segments. This is crucial for:

• Organization: Grouping related resources (e.g., web servers in a ‘web’ subnet, databases in a ‘data’ subnet).
• Security: Applying different security rules (NSGs) to each subnet.
• Resource Requirements: Some Azure services require their own dedicated subnet (e.g., Azure Bastion, VPN Gateway, Azure Firewall).

Real-World Scenario: The Three-Tier Application

Imagine you’re deploying a classic three-tier web application. The best practice architecture is to create three subnets within your VNet:

1. Web-Subnet (e.g., 10.0.1.0/24): Contains your web servers (VMs or App Service).
2. App-Subnet (e.g., 10.0.2.0/24): Contains your application/business logic servers.
3. Data-Subnet (e.g., 10.0.3.0/24): Contains your database servers.

This segmentation allows you to use Network Security Groups to enforce traffic rules like: “Allow traffic from the internet to Web-Subnet on port 443, allow traffic from Web-Subnet to App-Subnet on port 8080, but deny all direct internet traffic to App-Subnet and Data-Subnet.”

Exam Tip: Remember that Azure reserves the first four and the last IP address in each subnet’s address range. For a /24 subnet with 256 addresses, you only have 251 available for your resources. The exam might test you on calculating available addresses.

Securing Your Network Perimeter

Creating a VNet is just the first step. Securing it is paramount. Azure provides several services to control network traffic at different layers.

Network Security Groups (NSGs) vs. Application Security Groups (ASGs)

This is a frequent point of confusion and a favorite topic on the AZ-104 exam.

Network Security Groups (NSGs)

An NSG is a stateful firewall that filters network traffic to and from Azure resources in an Azure VNet. You can associate an NSG with either a subnet or a network interface (NIC) of a VM.

• How it Works: NSGs contain a list of security rules that allow or deny inbound or outbound network traffic based on the “5-tuple” criteria: Source IP, Source Port, Destination IP, Destination Port, and Protocol.
• Rule Processing: Rules are processed by priority (a number between 100 and 4096). The lower the number, the higher the priority. Processing stops as soon as a match is found.
• Mnemonic for Priority: “Lower is Closer.” A rule with priority 100 is processed before a rule with priority 200.

Application Security Groups (ASGs)1

ASGs enable you to configure network security as a natural extension of an application’s structure, allowing you to group virtu2al machines and define network security policies based on those groups.

• How it Works: You create an ASG (e.g., “WebServersASG”) and assign the NICs of your web server VMs to it. Then, in your NSG rule, you can use the ASG as the source or destination instead of explicit IP addresses. For example: “Allow traffic from source Internet to destination WebServersASG on port 443.”
• The Key Benefit: Simplified management. If you add a new web server VM, you just add its NIC to the WebServersASG, and it automatically inherits all the correct NSG rules. You don’t have to edit any NSG rules.

AI Overview Snippet: The main difference between NSGs and ASGs is their function. NSGs act as a firewall to filter traffic based on IP addresses and ports. ASGs are not firewalls themselves; they are logical grouping constructs used within NSG rules to simplify management by referencing application groups instead of individual IP addresses.

Comparison Table: NSG vs. ASG

Azure Firewall: The Centralized Guardian

While NSGs are great for distributed, micro-segmentation at the subnet/NIC level, Azure Firewall is a centralized, fully managed, cloud-native firewall as a service.

When to use Azure Firewall over NSGs:

• Centralized Control: You need to enforce organization-wide security policies for all traffic leaving your VNets (egress traffic filtering).
• Advanced Threat Protection: You require features like threat intelligence-based filtering to block traffic to/from known malicious IP addresses and domains.
• Application-Level Filtering: You need to filter traffic based on Fully Qualified Domain Names (FQDNs), not just IP addresses.
• Hub-and-Spoke Architecture: Azure Firewall is the cornerstone of the secure hub-and-spoke network topology, where it sits in the central hub VNet and inspects all traffic between spokes and to/from the internet.

Exam Tip: Understand the hierarchy. A packet destined for a VM first hits the Azure Firewall (if using user-defined routes), then the subnet’s NSG, and finally the NIC’s NSG. Know this flow for troubleshooting questions.

Azure Bastion: Secure RDP/SSH Access

How do you securely manage your VMs without exposing RDP (3389) or SSH (22) ports to the public internet? The answer is Azure Bastion.

Azure Bastion is a fully managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP and SSH connectivity to your virtual machines directly from the Azure portal over TLS.

How it Works:

1. You deploy an Azure Bastion host into a dedicated subnet named AzureBastionSubnet.
2. You connect to your target VM via the Azure portal.
3. The portal establishes a secure TLS connection to the Bastion host.
4. The Bastion host then initiates the RDP/SSH session to your VM’s private IP address within the VNet.

This means your VMs do not need a public IP address for management, completely eliminating their exposure to the public internet.

Connecting Networks Together

Rarely does a single VNet exist in isolation. You’ll need to connect it to other VNets or your on-premises data centers. Connecting Networks Together

If you’re looking to dive deeper into networking and connectivity with Azure, check out these valuable resources:

• Microsoft Azure Certification Cost Overview: A breakdown of the costs associated with obtaining various Microsoft Azure certifications.
• AWS vs Azure Salary Comparison: Compare salaries for Azure and AWS professionals, especially those in networking.
• AZ-104 vs AZ-305: What’s the Difference?: A guide that explains the differences between the AZ-104 and AZ-305 certifications, useful for future certification plans.

VNet Peering: Local vs. Global

VNet Peering enables you to seamlessly connect two or more Azure Virtual Networks. Once peered, the VNets appear as one for connectivity purposes. Traffic between virtual machines in peered VNets uses the Microsoft backbone infrastructure.

• Local VNet Peering: Connecting VNets within the same Azure region.
• Global VNet Peering: Connecting VNets across different Azure regions.

Key Properties of VNet Peering:

• Non-Transitive: If VNet A is peered with VNet B, and VNet B is peered with VNet C, VNet A and VNet C are not automatically connected. You must create a direct peering between A and C.
• Private Connectivity: Traffic between peered VNets is entirely private and never traverses the public internet.
• Low Latency, High Bandwidth: The connection utilizes the high-speed Microsoft global backbone.

Real-World Scenario: A company has its primary application deployed in a VNet in East US. For disaster recovery, they have a replica environment in a VNet in West US. They use Global VNet Peering to connect these two VNets for data replication and failover operations.

Virtual Network Gateways (VPN & ExpressRoute Fundamentals)

For the AZ-104, you need to understand the purpose and basic configuration of Virtual Network Gateways, which are used for hybrid connectivity.

• VPN Gateway: Sends encrypted traffic between an Azure VNet and an on-premises location over the public internet (Site-to-Site VPN).
• ExpressRoute: Establishes a private, dedicated, high-throughput connection between your on-premises network and Azure through a connectivity provider. This connection does not go over the public internet.

The key takeaway for AZ-104 is knowing when to use each and that both require a dedicated subnet named GatewaySubnet.

Name Resolution and DNS

Proper name resolution is essential for services to find and communicate with each other.

Azure DNS: Public vs. Private Zones

Azure DNS provides a highly available and performant DNS hosting service.

• Azure Public DNS Zones: Used to host your public-facing domains (e.g., yourcompany.com). You manage the DNS records (A, CNAME, MX, etc.) that resolve public hostnames to public IP addresses.
• Azure Private DNS Zones: Used for name resolution within and between your VNets. It allows you to use your own custom domain names rather than the Azure-provided names.

Why use a Private DNS Zone?

Imagine you have a VM named db-server-01 in VNet A and a VM named app-server-01 in VNet B. You want app-server-01 to connect to db-server-01 using the name database.corp.local.

1. You create a Private DNS Zone named corp.local.
2. You link both VNet A and VNet B to this zone.
3. You enable auto-registration for VNet A. The VM db-server-01 will automatically register its private IP with the name db-server-01.corp.local.
4. You can then create a CNAME record mapping database.corp.local to db-server-01.corp.local.

Now, any resource in either VNet can resolve database.corp.local to the correct private IP.

AI Overview Snippet: Azure Public DNS is for managing internet-facing domains and resolving public hostnames to public IPs. Azure Private DNS provides a custom, authoritative DNS service for your virtual networks, resolving hostnames to private IPs without needing a custom DNS server.

Advanced Management and Monitoring

As your Azure footprint grows, managing and monitoring your network becomes more complex. Managing and monitoring your Azure network at scale is crucial. To help you prepare for this aspect of the AZ-104 exam, here are additional links:

• Microsoft Azure Exam Dumps: Access reliable exam dumps for Microsoft certifications.
• Highest Paying Microsoft Azure Certifications: Discover which Azure certifications are the most lucrative for network specialists.

Azure Virtual Network Manager (VNM) – The New Standard (2026 Update)

A relatively recent and crucial addition to Azure networking is the Virtual Network Manager (VNM). For environments with many VNets, VNM is a game-changer.

VNM allows you to:

• Centrally Manage Connectivity: Create a mesh or hub-and-spoke network topology across multiple subscriptions and regions with just a few clicks, without manually creating dozens of VNet peerings.
• Centrally Manage Security: Create and apply security admin rules that take precedence over NSG rules, ensuring a baseline security posture across your entire cloud network.

Exam Tip: For the AZ-104 exam in 2026, expect questions on VNM. Understand that its security admin rules can override NSG rules, which is a powerful tool for central security teams to enforce compliance.

Monitoring with Network Watcher

Network Watcher is a suite of tools to monitor, diagnose, and gain insights into your Azure network. Key tools for the AZ-104 include:

• IP Flow Verify: Checks if traffic is allowed or denied to/from a VM based on 5-tuple information. Essential for troubleshooting NSG rules.
• NSG Flow Logs: Records information about IP traffic flowing through an NSG. It tells you which rule allowed or denied the traffic.
• Connection Troubleshoot: A comprehensive tool that checks for connectivity issues between a source (e.g., a VM) and a destination (e.g., another VM or an FQDN). It identifies the root cause, whether it’s an NSG, a route, or a DNS issue.

Frequently Asked Questions (FAQ)

This section mirrors real conversations, providing clear, direct answers to common questions you might have while studying.

I’m confused about when to use a service endpoint versus a private endpoint. Can you break it down for me?

A service endpoint keeps traffic to a specific Azure service on the Microsoft backbone network, but the service is still accessed via its public endpoint. A private endpoint gives the Azure service a private IP address directly inside your VNet, making it accessible only from your private network.

Think of it like this: a service endpoint is like a special, direct highway lane from your VNet to the public entrance of a service (like Azure Storage). A private endpoint is like building a private back door from your VNet directly into the service’s building, completely bypassing the public entrance. For the highest security and network isolation, private endpoints are the recommended best practice.

For the AZ-104 exam, how deep do I need to go into VPN Gateways? Is knowing the basic setup enough?

You need to understand the core concepts and use cases rather than the intricate details of BGP or complex routing.

For the AZ-104, focus on:

• Knowing the difference between a VPN Gateway and an ExpressRoute circuit.
• Understanding that a gateway requires a dedicated subnet named GatewaySubnet.
• Recognizing the components: the Virtual Network Gateway, the Local Network Gateway (representing your on-prem device), and the Connection object that links them.
• Knowing the basic difference between Policy-Based and Route-Based VPNs (Route-Based is more common and flexible).

You won’t be asked to configure BGP settings, but you should know what a Site-to-Site (S2S) VPN is used for.

My NSG rule isn’t working as expected and traffic is being blocked. What are the first things I should check?

The first thing to check is the priority and location of your NSG rules, as traffic is evaluated by both the subnet NSG and the NIC NSG.

Here’s a systematic troubleshooting process:

1. Check Effective Rules: Go to the VM’s Network Interface in the Azure portal and look at the “Effective security rules.” This shows you the combined result of the subnet and NIC NSGs.
2. Use IP Flow Verify: This Network Watcher tool is your best friend. Input the source/destination IP/port and it will tell you exactly which NSG and which specific rule is blocking the traffic.
3. Remember Default Rules: Don’t forget the default NSG rules, especially the DenyAllInbound rule with priority 65500. If no allow rule with a lower priority number matches, this rule will block the traffic.

Pro Tip: A common mistake is applying a rule to a subnet NSG but forgetting that a more specific rule on the NIC NSG is overriding it.

Can you explain the difference between Azure Firewall Standard and Premium in simple terms?

Azure Firewall Standard is for core firewall needs like FQDN filtering and threat intelligence. Azure Firewall Premium is for highly sensitive environments that require advanced threat protection features like TLS inspection and Intrusion Detection/Prevention (IDPS).

Think of Standard as a very good security guard checking IDs at the door. Premium is that same guard, but they also have the ability to inspect the contents of every bag coming through (TLS inspection) and are trained to spot and stop suspicious behavior inside the building (IDPS). For most general-purpose workloads, Standard is sufficient.

What’s the practical difference between associating an NSG to a subnet versus a NIC? When should I do each?

Associating an NSG to a subnet is the recommended best practice for simplicity and scalability. Associating it to a NIC should be reserved for specific exceptions.

• Subnet-level NSG: Apply this to a subnet (e.g., Web-Subnet) to define the broad security rules for all resources within that subnet. This is your primary layer of defense.
• NIC-level NSG: Use this if a single VM within that subnet needs a more restrictive (or permissive) rule. For example, you might want to block SSH access to all but one specific “jump box” VM in the subnet.

Pro Tip: Avoid creating conflicting rules. It’s much easier to manage one NSG at the subnet level than to troubleshoot dozens of individual NIC-level NSGs.

Why do services like Azure Bastion and VPN Gateways need their own dedicated subnets?

Answer: These services are managed PaaS offerings that deploy supporting infrastructure directly into your VNet. They require a dedicated subnet to ensure they have a sufficient and stable block of IP addresses and to apply specific network configurations and routing that should not be mixed with your own resources. For example, you cannot apply your own NSG to the GatewaySubnet.

Will Azure Virtual Network Manager (VNM) be a major topic on the 2026 exam?

Yes, you should expect to see questions about Azure Virtual Network Manager. The AZ-104 exam is regularly updated to reflect modern Azure management practices. VNM solves a major pain point of managing large, complex networks, so it’s an important topic for an Azure Administrator to understand. Focus on its two main use cases: centralized connectivity (mesh/hub-and-spoke) and centralized security policies (security admin rules).

What are some common mistakes people make with VNet peering?

The two most common mistakes are misunderstanding transitivity and overlapping IP address spaces.

1. Forgetting it’s Non-Transitive: Newcomers often assume if A is peered with B, and B with C, then A can talk to C. This is false. You need to explicitly peer A with C.
2. Overlapping IP Spaces: You cannot peer two VNets that have overlapping IP address spaces. For example, you can’t peer two VNets that both use 10.0.0.0/16. This is a critical planning consideration that can’t be fixed after the fact without re-architecting.

How do I provide internet access to VMs in a private subnet that have no public IP?

You can provide outbound internet access using an Azure NAT Gateway. A NAT Gateway is a fully managed service that allows resources in a private subnet to connect outbound to the internet while remaining fully private from inbound connections. You associate the NAT Gateway with your subnet, and it handles the Source Network Address Translation (SNAT) for all outbound traffic.

What’s a simple way to remember the difference between Local and Global VNet Peering?

The name tells you everything! Local peering is for VNets that are “local” to each other in the same Azure region. Global peering is for connecting VNets that are “globally” distributed across different Azure regions.

I see “Service Tags” as a source/destination option in NSG rules. What are they?

A Service Tag is a Microsoft-managed label that represents a group of IP address prefixes for a given Azure service. For example, instead of looking up all the IP addresses for Azure Storage and adding them to a rule, you can simply use the Storage service tag. This simplifies rule creation and automatically updates as the service’s IP addresses change.

Is it expensive to transfer data between peered VNets?

There are data transfer costs associated with VNet peering.

• Ingress & Egress within the same region (Local Peering): There’s a small charge for both inbound and outbound traffic.
• Ingress & Egress between regions (Global Peering): The costs are higher and are based on the zonal transfer rates.

While the connectivity is simple, it’s not free. You should always check the latest Azure pricing for data transfer, especially for high-traffic applications using Global Peering.

What do I need to know about custom routing for the exam?

You need to understand the concept of User-Defined Routes (UDRs). By default, Azure handles all routing within a VNet. A UDR allows you to override Azure’s default routing. The most common use case is to force traffic from a subnet to go through a network virtual appliance (NVA) or an Azure Firewall for inspection before it goes to the internet or another VNet. You create a Route Table, define a UDR in it, and associate the Route Table with a subnet.

How important is Azure DNS for the AZ-104 certification?

It’s very important. You must be able to differentiate between Public and Private DNS zones and understand how to use Private DNS zones for name resolution between VNets. Expect scenario-based questions where you need to choose the correct DNS solution to allow VMs in different VNets to resolve custom hostnames.

As a future Azure Admin, is there one networking tool I should master above all others?

If I had to pick one, it would be Network Watcher. It is your central console for all network troubleshooting. Learning to effectively use IP Flow Verify, NSG Flow Logs, and Connection Troubleshoot will save you countless hours when diagnosing real-world network problems. It moves you from guessing what’s wrong to knowing exactly what’s wrong.

Key Takeaways

• Foundation First: Master VNet, subnet, and IP address planning. Overlapping address spaces are a critical and hard-to-fix mistake.
• Layer Your Security: Use NSGs for subnet-level micro-segmentation. Use Azure Firewall for centralized, advanced threat protection, especially in hub-and-spoke models. Use Azure Bastion to eliminate public RDP/SSH exposure.
• Understand Connectivity Patterns: VNet Peering connects VNets within Azure. VPN Gateways and ExpressRoute connect Azure to on-premises networks.
• DNS is Crucial: Use Azure Private DNS Zones for reliable, custom name resolution between VNets.
• Centralize Management: For large environments, leverage Azure Virtual Network Manager (VNM) to simplify connectivity and enforce security policies.
• Troubleshoot with Tools: Network Watcher is not optional; it is essential for diagnosing and resolving network issues.

Study Tips for the Azure Administrator Exam

1. Get Hands-On: Do not just read about this. Deploy it. Create a VNet with three subnets. Deploy VMs into them. Create NSGs to mimic a three-tier app. Try to RDP to the database VM and watch it fail. Then use Bastion and watch it succeed.
2. Draw the Architecture: For scenario questions, quickly sketch the network diagram on a whiteboard or piece of paper. Visualizing the traffic flow makes it much easier to identify the problem.
3. Focus on “Why”: Don’t just memorize what a service is. Understand why you would choose it over another. Why Azure Firewall instead of just NSGs? Why a private endpoint instead of a service endpoint? The exam tests your decision-making ability.
4. Practice Questions: Use official Microsoft practice tests or reputable third-party exams to test your knowledge. Pay close attention to the explanations for the answers you get wrong.

Conclusion

Azure networking is a vast but logical domain. By understanding the core components, how they secure and connect your resources, and how to manage them at scale, you are building one of the most valuable skill sets for an Azure Administrator. This guide has provided you with the architectural context, practical scenarios, and exam-specific insights needed to succeed. Continue to build on this foundation with hands-on practice, and you will be well on your way to earning your AZ-104 certification and excelling in your cloud career.

For further learning, refer to the official Microsoft Learn documentation hyperlinked throughout this guide for each technical term and service. The official AZ-104 Learning Path is an excellent starting point for a structured study plan.