Clarification on Impact of Default Outbound Access Retirement for VMSS VMs

Question

Clarification on Impact of Default Outbound Access Retirement for VMSS VMs

Koteru Reddy (LTIMindtree Limited) 20 Microsoft External Staff

Hi

We would like to confirm the impact of the upcoming retirement of Default outbound access for VMs in Azure on our Virtual Machine Scale Set (VMSS) workloads.

Currently, we are using VMSS-based VMs for on-demand deployments in conformance test validation (non-production use case) and need clarity on the following points:

Once default outbound access is retired, how will outbound internet connectivity be impacted for VMSS VMs?

If we assign explicit public IPs to individual VM NICs within the VMSS, will this be a supported and recommended approach for outbound internet access for small scale deployments?

Alternatively, if we configure a NAT Gateway for the subnet, would this be the preferred method in terms of reliability and Azure best practices?

Which option (per-VM Public IP vs. subnet-level NAT Gateway) is recommended for ensuring uninterrupted connectivity in our test scenario?

Please advise on the best approach to keep our VMSS-based test workloads functional after the retirement deadline, specifically in terms of cost optimization and long-term support.

Note: These workloads are temporary and are destroyed automatically once the runtime validation completes.

Anusree Nashetty 6,395 Reputation points Microsoft External Staff Moderator

2025-08-28T18:40:48.2633333+00:00

Hi Koteru Reddy (LTIMindtree Limited),

Did you get a chance to see my response for your follow up query. If you have any further queries, let me know. If the information is helpful, please click on Upvote and Accept Answer on it.

Answer accepted by question author

2 additional answers

Your answer

Anusree Nashetty 6,395 Reputation points Microsoft External Staff Moderator

2025-08-28T18:40:48.2633333+00:00

Hi Koteru Reddy (LTIMindtree Limited),

Did you get a chance to see my response for your follow up query. If you have any further queries, let me know. If the information is helpful, please click on Upvote and Accept Answer on it.

Answer 1

Hi Koteru Reddy (LTIMindtree Limited),

The retirement of default outbound access for Azure VMs, including those in Virtual Machine Scale Sets (VMSS), necessitates strategies to maintain outbound internet connectivity. Below are how this change impacts your workloads and recommended approaches to ensure continued functionality:

Impact on workloads:

Loss of automatic outbound connectivity: VMSS instances will no longer automatically get outbound internet connectivity without alternative configurations, which could potentially disrupt your testing workflows.

Outbound connectivity options:

Explicit public IPs for VM NICs

Supported: Assigning individual public IP addresses to each VM's network interface is a straightforward way to ensure outbound access.

Simple setup for small scale deployments.
Direct control over IP addresses for each VM.

NAT gateway for the subnet:

Preferred approach: Configuring a NAT gateway for the entire subnet can be a more scalable and cost-effective solution for managing outbound traffic.

A single NAT gateway can cover multiple VMs, simplifying IP management.
Improved reliability since NAT gateway offers better handling of outbound connectivity.
Reduces costs as you avoid paying for individual public IP addresses for each VM.

Recommended approach for your test workloads

NAT gateway configuration: Given that your workloads are temporary and automatically destroyed after validation, configuring a NAT gateway would likely be the best practice. It provides:

Reliable outbound connectivity.
Cost savings compared to provisioning multiple public IPs.
Scalability permitting you to easily adapt to changes in the number of VMs in your VMSS.

Cost optimization and long-term support:

Cost management: Use Azure Pricing calculatorto estimate costs associated with NAT gateway vs individual public IPs to find the most cost-effective solution.

Long-term considerations: As Azure cloud services evolve, employing standardized networking practices, such as NAT gateway, aligns with Azure's best practices, ensuring that your configurations remain valid and optimized as Azure continues to update its services.

Please refer : https://free.blessedness.top/en-us/azure/nat-gateway/nat-overview
https://free.blessedness.top/en-us/azure/virtual-network/ip-services/public-ip-addresses#outbound-connections
https://free.blessedness.top/en-us/azure/virtual-network/ip-services/public-ip-addresses

Koteru Reddy (LTIMindtree Limited) 20 Reputation points Microsoft External Staff

2025-08-25T08:23:08.64+00:00

Hi @Satish Mada , thanks for the quick response.I tried validating the suggested approach. When using NAT Gateway, it requires Bastion for SSH connectivity to the VMs, which adds additional complexity in our case. Since we typically use no more than five worker nodes for validations (with a default of two worker nodes), assigning explicit public IPs to the VMs seems to be a simpler fit for our environment.

Given this requirement, which approach would you recommend as the better option for our use case — NAT Gateway with Bastion or assigning explicit public IPs?

Answer 2

Deepanshu katara 17,875 MVP Moderator

Hello ,

Given your scenario:

Temporary VMSS workloads for test validation
Small scale deployments
Cost sensitivity

🔹 Recommended Approach:

Use NAT Gateway at the subnet level if:

You want long-term support, scalability, and security.
You expect multiple VMs or frequent deployments.

Use per-VM Public IPs if:

You have very few VMs.
You need a quick and simple setup.
You are okay with managing IPs manually and accept the security trade-offs. Kindly check this for more details -->https://free.blessedness.top/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-inbound-and-outbound-internet-connectivity Pls check and let us know if any further ques

Thanks

Deepanshu

Hareshbhai Khambhadiya (LTIMindtree Limited) 0 Reputation points Microsoft External Staff

2025-08-22T17:05:13.5333333+00:00
@Deepanshu katara

If we create VMSS and VM with below command.
Assume all require variables are exported and correct.

Subnet is without NAT GATEWAY; there are no default route to on-prem firewall or any other network device, No kind of Load balancer or SNAT. Subnet get created with "defaultOutboundAccess": false,

Will that VM get outbound internet access after 9/30?

az vmss create -n vmss -g $RESOURCE_GROUP --platform-fault-domain-count 1 az vm create -n bootstrap-node -g $RESOURCE_GROUP --image $OS_IMAGE \ --location $LOCATION --size $VM_SIZE --os-disk-size-gb $OS_DISK_SIZE_GB --vmss vmss \ --vnet-name k8s-vnet --subnet k8s-subnet --public-ip-sku Standard --tags $tags \ --admin-username k8s --ssh-key-value k8skey.pub --nsg k8s \ --assign-identity $AZ_IDENTITY_ID

Answer 3

Hi Koteru Reddy (LTIMindtree Limited),

Thanks for getting back.

For a small, short-lived validation environment with up to five worker nodes, assigning explicit public IPs to each VM is the better option, offering an easier setup and direct SSH access without Bastion's added complexity.

Direct Public IPs are simple & Effective:
Each VM receives its own public IP, allowing straightforward SSH access with minimal configuration steps.
Eliminates the need for a Bastion host, reducing operational overhead and potential trouble spots for connectivity.
Suitable for environments where security and compliance requirements do not strictly mandate private access only, especially given the limited scale.

NAT Gateway with Bastion: Complexity vs Benefit
While NAT Gateway is preferred for larger environments for outbound traffic management and cost optimization, it does not allow direct inbound SSH; Bastion is required for secure access.
The dual setup (NAT + Bastion) increases configuration complexity and may add costs, which is unnecessary for fewer than five nodes deployed temporarily.

If you have any further queries, let me know. If the information is helpful, please click on Upvote.

Share via

Clarification on Impact of Default Outbound Access Retirement for VMSS VMs

2 additional answers

Your answer