Azure Fundamentals · Lesson 2 of 3
Azure Virtual Networks
Explain what an Azure virtual network is, describe how its address space is divided into subnets, follow traffic from the internet to a VM, and describe how network security groups allow or deny traffic.
Tip: turn your phone sideways or use full screen for larger labels.
Captions match the narration word for word. Narration uses your browser's built-in voice, so it sounds different on each device. Press Space to play or pause and the arrow keys to change scenes.
Learning objective
Explain what an Azure virtual network is, describe how its address space is divided into subnets, follow traffic from the internet to a VM, and describe how network security groups allow or deny traffic.
Recap
- A VNet is a logical, isolated network for your Azure resources, defined in software.
- Its address space (for example 10.0.0.0/16) is divided into subnets. Use private ranges and avoid overlaps with networks you may connect.
- Azure reserves five addresses in every subnet: the first four and the last.
- A VM joins a subnet through its network interface, which gets a private IP from that subnet. A public IP is optional.
- Network security groups allow or deny traffic with rules checked in priority order (lower number first). Connectivity always depends on configuration.
Knowledge check
Test yourself
Question 1. A subnet uses 10.0.1.0/24. Why does the first VM get 10.0.1.4 rather than 10.0.1.1?
- Azure reserves the first four and the last address in every subnet
- 10.0.1.1 is always assigned to the NSG
- Azure assigns addresses at random
Show answer
A. Azure reserves the first four and the last address in every subnet. Azure reserves five addresses in each subnet: the network address, three addresses for Azure services such as the default gateway and DNS, and the last address.
Question 2. An NSG has a custom rule at priority 100 allowing HTTPS (443) from the internet, plus the default rules. Is an SSH request (port 22) from the internet allowed?
- Yes, because the NSG allows internet traffic
- No, it matches no allow rule and reaches DenyAllInbound (65500)
- Yes, SSH is always allowed for administrators
Show answer
B. No, it matches no allow rule and reaches DenyAllInbound (65500). Rules are checked in priority order. Port 22 doesn't match the priority-100 HTTPS rule, so it falls through to the default DenyAllInbound rule and is denied.
Voiceover script
Script and on-screen text
The full narration, scene by scene, with the headline shown on screen. The captions file below contains the same text with timings.
Scene 1 · 0:00
On screen: Lesson 2: Azure Virtual Networks
In Lesson 1, our web app's virtual machine had a network interface connected to something called a virtual network. In this lesson, we'll open that up: what a virtual network is, how it's divided into subnets, and how traffic is allowed or blocked on its way to the VM.
Scene 2 · 0:22
On screen: A VNet is a logical network in Azure
An Azure virtual network, or VNet, is a logical network for your Azure resources. It's isolated from other customers' networks, and inside it you decide how resources are addressed, how they're grouped and how traffic is filtered. Think of it as the private network you'd build in an office, but defined in software.
Scene 3 · 0:45
On screen: Address space: the VNet's IP range
Every VNet has an address space: a range of private IP addresses, written in CIDR notation. In our example, it's 10.0.0.0/16, which contains 65,536 addresses. Microsoft recommends private ranges like this one. Plan the range carefully, so it doesn't overlap with other networks you might connect later.
Scene 4 · 1:06
On screen: Subnets divide the address space
We divide the address space into subnets. Here, snet-web, 10.0.1.0/24, is for our web tier, and snet-data, 10.0.2.0/24, leaves room for other resources later. Subnets let you group resources and apply different security rules to each group.
Scene 5 · 1:23
On screen: The VM joins a subnet through its NIC
Our VM sits in the web subnet. Its network interface receives a private IP address from the subnet's range: in this example, 10.0.1.4. Why not .1? Azure reserves five addresses in every subnet: the first four and the last. Here, that's .0 to .3, and .255.
Scene 6 · 1:43
On screen: From the internet to the app
For users on the internet to reach the app, there has to be a way in. In our example, the VM's network interface has a public IP address. A request travels from the browser, across the internet, to that public IP, and Azure delivers it to the VM's private address. Other designs use a load balancer or gateway instead.
Scene 7 · 2:09
On screen: Network security groups filter traffic
But should every request get through? A network security group, or NSG, is a set of rules that allow or deny traffic. You can associate one with a subnet or with a network interface. Each rule matches traffic by source, destination, port and protocol, and has a priority from 100 to 4096. Lower numbers are checked first, and once traffic matches a rule, processing stops.
Scene 8 · 2:38
On screen: Allowed and denied traffic
Our example NSG has a rule at priority 100 that allows HTTPS on port 443 from the internet, so web requests get through. An SSH connection attempt from the internet, on port 22, matches no allow rule. It falls through to the default rule, DenyAllInbound, at priority 65500, and it's denied. Default rules have the lowest priority, so your own rules are always checked first.
Scene 9 · 3:06
On screen: Connectivity depends on configuration
Here's the key takeaway: being in Azure doesn't guarantee connectivity. Traffic flows only when the configuration allows it: the VNet and subnet, the network interface and its addresses, the NSG rules, the routes, and of course an application that's actually listening on the port. When something can't connect, check each of these in turn.
Scene 10 · 3:30
On screen: Recap: virtual networks
To recap: a VNet is a logical, isolated network for your Azure resources. Its address space is divided into subnets. A VM connects to a subnet through its network interface. And network security groups filter traffic with prioritized allow and deny rules. In Lesson 3, our app stores the uploaded photos in Azure Blob Storage.
Storyboard
Timestamped storyboard
Scene-by-scene direction for animators or video tools. Timings assume narration at about 145 words per minute.
| Time | Narration | Visual scene | Animation or transition | On-screen labels |
|---|---|---|---|---|
| 0:00–0:22 | In Lesson 1, our web app's virtual machine had a network interface connected to something called a virtual network. In this lesson, we'll open that up: what a virtual network is, how it's divided into subnets, and how traffic is allowed or blocked on its way to the VM. | Title over the empty Azure region outline. | Title fades in; region outline draws. |
|
| 0:22–0:45 | An Azure virtual network, or VNet, is a logical network for your Azure resources. It's isolated from other customers' networks, and inside it you decide how resources are addressed, how they're grouped and how traffic is filtered. Think of it as the private network you'd build in an office, but defined in software. | A large dashed blue VNet boundary appears inside the region. | VNet boundary draws clockwise; highlighted. |
|
| 0:45–1:06 | Every VNet has an address space: a range of private IP addresses, written in CIDR notation. In our example, it's 10.0.0.0/16, which contains 65,536 addresses. Microsoft recommends private ranges like this one. Plan the range carefully, so it doesn't overlap with other networks you might connect later. | An address-space tag appears under the VNet name. | Tag fades in and is highlighted. |
|
| 1:06–1:23 | We divide the address space into subnets. Here, snet-web, 10.0.1.0/24, is for our web tier, and snet-data, 10.0.2.0/24, leaves room for other resources later. Subnets let you group resources and apply different security rules to each group. | Two dashed subnet boxes appear inside the VNet, each with its address range. | Subnets split out of the VNet area from the center. |
|
| 1:23–1:43 | Our VM sits in the web subnet. Its network interface receives a private IP address from the subnet's range: in this example, 10.0.1.4. Why not .1? Azure reserves five addresses in every subnet: the first four and the last. Here, that's .0 to .3, and .255. | The VM appears in snet-web with its NIC showing 10.0.1.4; a note lists the reserved addresses. | VM and NIC slide in; reserved-address note appears; both highlighted. |
|
| 1:43–2:09 | For users on the internet to reach the app, there has to be a way in. In our example, the VM's network interface has a public IP address. A request travels from the browser, across the internet, to that public IP, and Azure delivers it to the VM's private address. Other designs use a load balancer or gateway instead. | Browser and internet appear on the left; a public IP badge sits between the internet and the NIC; a labeled request path runs browser → internet → public IP → NIC. | Request path draws left to right; a dot travels along it. |
|
| 2:09–2:38 | But should every request get through? A network security group, or NSG, is a set of rules that allow or deny traffic. You can associate one with a subnet or with a network interface. Each rule matches traffic by source, destination, port and protocol, and has a priority from 100 to 4096. Lower numbers are checked first, and once traffic matches a rule, processing stops. | A shield labeled NSG appears on the web subnet; a rules table lists priority, rule and action. | Shield pops in; rules table slides in from the right. |
|
| 2:38–3:06 | Our example NSG has a rule at priority 100 that allows HTTPS on port 443 from the internet, so web requests get through. An SSH connection attempt from the internet, on port 22, matches no allow rule. It falls through to the default rule, DenyAllInbound, at priority 65500, and it's denied. Default rules have the lowest priority, so your own rules are always checked first. | Two paths: the HTTPS path reaches the NIC; a second, red dashed path for SSH stops at the NSG shield with a ✕ label. | Allowed path animates; denied path draws and stops at the shield; ✕ label appears. |
|
| 3:06–3:30 | Here's the key takeaway: being in Azure doesn't guarantee connectivity. Traffic flows only when the configuration allows it: the VNet and subnet, the network interface and its addresses, the NSG rules, the routes, and of course an application that's actually listening on the port. When something can't connect, check each of these in turn. | A checklist panel replaces the rules table: five items with check boxes. | Checklist items tick in one by one. |
|
| 3:30–3:54 | To recap: a VNet is a logical, isolated network for your Azure resources. Its address space is divided into subnets. A VM connects to a subnet through its network interface. And network security groups filter traffic with prioritized allow and deny rules. In Lesson 3, our app stores the uploaded photos in Azure Blob Storage. | The complete network diagram with the allowed HTTPS path. | All parts visible; request path loops. |
|
Sources and accuracy
Technical details were checked against Microsoft Learn on October 13, 2026. Azure changes often, so check the current documentation before relying on a specific detail. The example architecture, names, sizes and addresses are illustrative only.
- What is Azure Virtual Network? (Microsoft Learn)
- Azure Virtual Network FAQ (address ranges, reserved addresses) (Microsoft Learn)
- Network security groups overview (Microsoft Learn)
- Public IP addresses (Microsoft Learn)
Want hands-on Azure training for your team?
I run beginner-to-advanced Azure sessions built around your own environment and goals.