Lesson 1: The Azure Networking Map on One Page

Why start with a map

Azure lists more than twenty networking products. Several of them overlap: Load Balancer, Application Gateway, Front Door and Traffic Manager all "balance load". Some also have old names or old tiers that still turn up in tutorials, Terraform modules and your own subscription. If you can't place a product on the map, you'll compare the wrong things. This level gives you the whole map on one page, so that every later lesson has a place to sit.

Think of it like a city plan. Virtual networks are the plots of land. Connectivity and hybrid links are the roads between plots and out to your office. Load balancing and delivery are the front doors and reception desks. DNS is the street directory. Private access is the private side gate into Azure's own buildings. Security is the guards and the fences. Monitoring is the CCTV.

The map: eight groups

Gotcha: the WAF is not a product of its own. It is a policy you attach to Application Gateway or Front Door, so look for it there.

Former names and retiring tiers

This table matters for two reasons: old blog posts still use these names, and your estate may still contain them.

The default-outbound change catches people out. A VM in a new private subnet can't reach Windows Update or a public API until you give it an explicit way out.

Walkthrough: find legacy items in a subscription

Run these in Cloud Shell to see how much of the old map you still own:

# 1. Basic SKU load balancers (retired 30 Sep 2025)
az network lb list --query "[?sku.name=='Basic'].{name:name, rg:resourceGroup}" -o table

# 2. Application Gateway v1: tier 'Standard' or 'WAF' with no _v2 suffix
az network application-gateway list \
  --query "[?sku.tier=='Standard' || sku.tier=='WAF'].{name:name, tier:sku.tier}" -o table

# 3. Front Door (classic) uses the old resource type Microsoft.Network/frontDoors
az resource list --resource-type Microsoft.Network/frontDoors -o table

# 4. Subnets that still allow default outbound access
#    (null or true means not private)
az network vnet subnet list -g rg-app --vnet-name vnet-app \
  --query "[].{subnet:name, defaultOutbound:defaultOutboundAccess}" -o table

Example output for step 4:

Subnet    DefaultOutbound
--------  ---------------
web       None      <- older subnet, implicit internet access
data      False     <- private: needs NAT Gateway or similar to get out

Best practice: treat None as a finding to fix, not as a feature. The default outbound IP belongs to Microsoft and can change without notice.

Using the map: from a need to a shortlist

The map's real job is to turn a need into two or three candidates fast. Then later lessons help you choose between them.

A simple heuristic: first ask whether the traffic is HTTP or not and whether it is global or regional. Those two questions narrow the four load-balancing services down to one or two.

Key takeaways

• Azure networking fits into eight groups: virtual networks, connectivity, hybrid, load balancing and delivery, DNS, private access, security and monitoring.
• The WAF is a policy on Application Gateway or Front Door, not a separate service.
• Front Door (classic) retires 31 March 2027. App Gateway v1 and Basic Load Balancer have already retired. Non-AZ VPN SKUs and NSG flow logs are being phased out.
• New VNets (newer API versions) get private subnets, so plan explicit outbound access, with NAT Gateway as the usual choice.
• Use the map to build a shortlist first, then compare the candidates.