Default outbound access for VMs in Azure will be retired—transition existing VMs to a new method of internet access

Question

Hi All,

I have receive the above message from Azure Service Health, 'Default outbound access for VMs in Azure will be retired'.

All my VM is already using standard SKU and fronted by Azure Application gateway.

The service health also suggest to "utilize Azure Advisor and look for the “Add explicit outbound method to disable default outbound” recommendation in the “Operational excellence” section to show the specific virtual machine NICs using default outbound.

When I access Operational excellence in Azure Advisor, I dont see any list of my VM or workload that is exposed with default outbound access.

Question is, while my VM is already all on standard public IP address SKU (dynamic IP), is this not sufficient? or do I still need to setup a NAT gateway or a LB with outbound rules? As mention, I am already using Azure Application Gateway. Are there any other methods that I can detect which VM is the culprit because azure advisor does not provide me with anything. or can I simply disable the messahe above from service health?

Appreciate the help.

Answer 1

Hi,

Got the same message today.

I checked all recommendations in Azure Advisor and couldn't find anything about the "Add explicit outbound method to disable default out-bound"

"
In order to determine which virtual machines for your subscription are in scope, please utilize Azure Advisor and look for the “Add explicit outbound method to disable default outbound” recommendation in the “Operational excellence” section to show the specific virtual machine NICs using default outbound.
"

Answer 2

It seems like they've removed it from Advisor. I saw it being there yesterday, but today it's gone.

Answer 3

Hi Rusydan (Dan),

The retirement of default outbound access for VMs in Azure. Since your VMs are already using Standard SKU public IP addresses, this meets the requirement for explicit outbound connectivity, provided each VM has an assigned public IP.

However, as Azure Application Gateway handles inbound traffic, you still need to configure an explicit outbound method (e.g., NAT Gateway or Standard Load Balancer with outbound rules) if any VM relies on default outbound access.

If Azure Advisor's "Operational Excellence" section does not show recommendations, it likely indicates no VMs are dependent on default outbound access. However, double-check your NICs and subnet configurations to confirm compliance. Service Health alerts cannot be disabled individually, but you can manage notifications via Azure Monitor.

Please refer to the below documentation

Default outbound access in Azure: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access

Azure Advisor recommendations: https://learn.microsoft.com/en-us/azure/advisor/advisor-reference-operational-excellence-recommendations

If it was helpful, please click "Upvote" on this post to let us know.

Thank You.