We recently announced that on 30 September 2025, default outbound access connectivity for all new virtual machines in Azure will be retired. We received a great deal of engagement on this initial announcement and had some additional information to share.
As noted, for enhanced security, Azure is moving towards a secure-by-default model. This means default outbound access to the internet will be turned off. After 30 September 2025, Azure will no longer assign a default implicit IP for VMs to communicate to the internet. Existing VMs will not be impacted by this retirement.
If you require outbound access after this date, you will have an easy way to enable outbound internet access with explicit outbound methods. Similarly, if you currently have VMs with default outbound access and would like to move to a secure by default configuration after this date, we will provide a mechanism to opt in with ease. At any time, you can transition to an explicit outbound method that Azure offers. If you are already using explicit outbound connectivity methods, you will not be impacted by this retirement.
Explicit outbound connectivity methods provide:
- Greater control over how and when they connect to the internet
- Safety from public IP address changes, so you have predictable ranges
- Traceable IP address resources that you own, which is beneficial for measurement and troubleshooting
Over the coming months, periodic updates will be sent via email to Azure subscription owners impacted by this change, so please keep an eye out. If you have questions, get answers from community experts in Microsoft Q&A. If you have a support plan and you need technical help, create a support request.
