Azure virtual networks can be created using the Azure portal, Azure CLI, Azure PowerShell, ARM templates or Bicep, Terraform and the REST API / SDKs. They all create the same VNet. Use the portal to learn, and code (CLI, Bicep or Terraform) for repeatable, real environments.
📑 On this page · 7 sections
Tools you can use to create a VNet
Azure portal
Point-and-click. Best for learning.
Azure CLI
az network vnet create — quick scripts.
Azure PowerShell
New-AzVirtualNetwork — Windows-friendly automation.
ARM / Bicep
Azure-native infrastructure as code.
Terraform
azurerm_virtual_network — multi-cloud IaC.
REST API / SDKs
Create networks from your own apps.
What is an Azure Virtual Network?
A VNet is your own private network in Azure. VMs, private endpoints and AKS clusters inside it talk to each other securely, and you control how they reach the internet and on-premises.
Address space
Private IP range, e.g. 10.0.0.0/16.
Subnets
Smaller ranges to group resources.
NSGs
Rules that allow or deny traffic.
Connectivity
Peering, VPN Gateway, ExpressRoute.
• Isolation and security — keep resources private
• Segmentation — separate web, app and database tiers
• Hybrid connectivity — VPN or ExpressRoute to your office
• Private access to PaaS — private endpoints keep traffic off the internet
• Scalability — add subnets and peer VNets as you grow
Step by step: create a VNet in the Azure portal
Sign in
Open the Azure portal.
Create
Search Virtual networks and click Create.
Basics
Subscription, resource group, name (e.g. vnet-app-prod) and region.
Security
Optionally enable Bastion, Azure Firewall or DDoS Protection.
IP addresses
Address space 10.0.0.0/16, subnet 10.0.1.0/24 for web.
Review + create
Check settings, create, then add an NSG to each subnet.
Create a VNet with Azure CLI
az network vnet create \
--resource-group rg-network \
--name vnet-app-prod \
--address-prefix 10.0.0.0/16 \
--subnet-name snet-web \
--subnet-prefix 10.0.1.0/24In PowerShell use New-AzVirtualNetwork with New-AzVirtualNetworkSubnetConfig. In Bicep, ARM or Terraform, define the VNet once and deploy the same network every time.
🌐 Want to build VNets, NSGs, peering and VPNs in real labs? Join a free Azure Admin demo class.
Book a free demoExample VNet designs
Three-tier app
Web, app and database subnets with NSGs between them and a private endpoint for Azure SQL.
Hub-and-spoke
A hub VNet with shared firewall and VPN gateway, peered to spoke VNets per app.
Hybrid
A VNet connected to the office through site-to-site VPN or ExpressRoute.
Best practices for Azure VNets
✕ Overlapping IP ranges with on-premises or other VNets
✕ Public IPs on VMs instead of Azure Bastion
✕ One flat subnet for everything
✕ PaaS services reached over the public internet
✕ Networks built by hand with no code
✅ ✅ Do this instead: Plan non-overlapping IP ranges, separate tiers with subnets + NSGs, use private endpoints and Bastion, adopt hub-and-spoke for larger setups, and build networks with Bicep or Terraform. Azure Virtual Network Manager helps manage many VNets centrally.
Keep learning networking
Read Azure DNS server, Azure Firewall pricing and Azure networking certification.
Frequently asked questions
Azure virtual networks can be created using which tools?
The Azure portal, Azure CLI, Azure PowerShell, ARM templates or Bicep, Terraform, and the REST API or SDKs.
What is an Azure Virtual Network?
A private, isolated network in Azure with your own IP ranges, subnets and security rules.
What is a subnet?
A smaller IP range inside a VNet used to group and secure resources.
How do I connect two VNets?
Use VNet peering, or a VPN gateway for VNet-to-VNet connections.
Is there a cost for Azure VNets?
Creating a VNet is free. You pay for things like peering traffic, gateways, public IPs and firewalls.