Configure disable peering route propagation

When you disable peering route propagation, you suppress system-generated IPv4 and IPv6 peering routes for supported workloads on subnets associated with a route table. This article shows you how to configure the public preview capability by using the Azure portal, Azure CLI, or Azure PowerShell.

Before you configure this setting, review how disable peering route propagation works, its benefits, and its limitations.

Prerequisites

• An Azure account with an active subscription. Create an account for free.
• An existing route table associated with the subnets where you want to suppress peering routes. For more information, see Associate a route table to a subnet.
• The required UDRs and an Azure Firewall or NVA next hop in the same virtual network as the source workload's network interface.
• The Microsoft.Network/AllowDisablePeeringRoutes preview feature registered for the subscription that contains the route table. For registration steps and required permissions, see Set up preview features in an Azure subscription.

Azure portal

Sign in to the Azure portal.

Azure CLI

Install the latest Azure CLI. Sign in to the subscription that contains the route table by using az login.

Register the preview feature:

az feature register \
  --namespace Microsoft.Network \
  --name AllowDisablePeeringRoutes

Check the registration state:

az feature show \
  --namespace Microsoft.Network \
  --name AllowDisablePeeringRoutes \
  --query properties.state \
  --output tsv

Wait until the state is Registered, and then refresh the resource provider registration:

az provider register --namespace Microsoft.Network

Azure PowerShell

Install the latest Azure PowerShell and Az.Network module version 8.1.0 or later. Sign in to the subscription that contains the route table by using Connect-AzAccount.

You must register the preview feature before you continue. For registration steps, see Set up preview features in an Azure subscription.

Disable peering route propagation

Azure portal

1. In the search box at the top of the Azure portal, enter Route tables. Select Route tables in the search results.
2. Select the route table associated with the subnets where you want to suppress peering routes.
3. Under Settings, select Configuration.
4. Clear Enable peering routes (Preview).
5. Select Save.

To restore system-generated peering routes, select Enable peering routes (Preview), and then select Save.

Azure CLI

Use az network route-table update to disable peering route propagation. Replace <resource-group> and <route-table-name> with your values:

az network route-table update \
  --resource-group "<resource-group>" \
  --name "<route-table-name>" \
  --disable-peering-route All

To restore system-generated peering routes, run the same command with --disable-peering-route None.

Azure PowerShell

Use Get-AzRouteTable and Set-AzRouteTable to update an existing route table. Replace <resource-group> and <route-table-name> with your values:

$routeTable = Get-AzRouteTable `
  -ResourceGroupName "<resource-group>" `
  -Name "<route-table-name>"

$routeTable.DisablePeeringRoute = "All"

Set-AzRouteTable -RouteTable $routeTable

To restore system-generated peering routes, retrieve the current route table, set $routeTable.DisablePeeringRoute to "None", and save it with Set-AzRouteTable.

When you use REST, Azure Resource Manager templates, or Bicep, use API version 2025-07-01 or later for the route table. For the property definition, see Microsoft.Network/routeTables.

Verify route suppression

Check the effective routes for a network interface in a subnet associated with the route table. The routes with next hop type Virtual network peering should be suppressed for supported workloads. Confirm that the required UDRs direct traffic to the intended next hop.

For more information, see Diagnose a virtual machine routing problem.

Next step

Learn more about virtual network peering