Add or remove a subnet delegation

Subnet delegation gives explicit permissions to the service to create service-specific resources in the subnet using a unique identifier when deploying the service. This article describes how to add or remove a delegated subnet for an Azure service.

Prerequisites

  • An Azure account with an active subscription. Create an account for free.

  • If you didn't create the subnet you would like to delegate to an Azure service, you need the following permission: Microsoft.Network/virtualNetworks/subnets/write. The built-in Network Contributor role also contains the necessary permissions.

  • This how-to article requires version 2.31.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.

  • Azure PowerShell installed locally or Azure Cloud Shell.

  • Sign in to Azure PowerShell and ensure you've selected the subscription with which you want to use this feature. For more information, see Sign in with Azure PowerShell.

  • Ensure your Az.Network module is 4.3.0 or later. To verify the installed module, use the command Get-InstalledModule -Name "Az.Network". If the module requires an update, use the command Update-Module -Name Az.Network if necessary.

If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you're running PowerShell locally, you also need to run Connect-AzAccount to create a connection with Azure.

Create the virtual network

In this section, you create a virtual network and the subnet that you'll later delegate to an Azure service.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select + Create.

  4. Enter or select the following information in the Basics tab of Create virtual network:

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select Create new.
    Enter myResourceGroup in Name.
    Select OK.
    Instance details
    Name Enter myVNet.
    Region Select East US 2
  5. Select Next: IP Addresses.

  6. In IPv4 address space, enter 10.1.0.0/16.

  7. Select + Add subnet.

  8. Enter or select the following information in Add subnet:

    Setting Value
    Name Enter mySubnet.
    Subnet address range Enter 10.1.0.0/24.
  9. Select Add.

  10. Select Review + create.

  11. Select Create.

Delegate a subnet to an Azure service

In this section, you delegate the subnet that you created in the preceding section to an Azure service.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select myVNet.

  4. Select Subnets in Settings.

  5. Select mySubnet.

  6. Enter or select the following information:

    Setting Value
    SUBNET DELEGATION
    Delegate subnet to a service Select the service that you want to delegate the subnet to. For example, Microsoft.Sql/managedInstances.
  7. Select Save.

Remove subnet delegation from an Azure service

In this section, you'll remove a subnet delegation for an Azure service.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select myVNet.

  4. Select Subnets in Settings.

  5. Select mySubnet.

  6. Enter or select the following information:

    Setting Value
    SUBNET DELEGATION
    Delegate subnet to a service Select None.
  7. Select Save.

Next steps