Add or remove a subnet delegation

Subnet delegation gives explicit permissions to the service to create service-specific resources in the subnet using a unique identifier when deploying the service. This article describes how to add or remove a delegated subnet for an Azure service.

Prerequisites

  • An Azure account with an active subscription. Create an account for free.

  • If you didn't create the subnet you would like to delegate to an Azure service, you need the following permission: Microsoft.Network/virtualNetworks/subnets/write. The built-in Network Contributor role also contains the necessary permissions.

Create the virtual network

In this section, you create a virtual network and the subnet that you delegate to an Azure service.

The following procedure creates a virtual network with a resource subnet.

  1. In the portal, search for and select Virtual networks.

  2. On the Virtual networks page, select + Create.

  3. On the Basics tab of Create virtual network, enter or select the following information:

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select Create new.
    Enter test-rg in Name.
    Select OK.
    Instance details
    Name Enter vnet-1.
    Region Select East US 2.

    Screenshot of Basics tab of Create virtual network in the Azure portal.

  4. Select Next to proceed to the Security tab.

  5. Select Next to proceed to the IP Addresses tab.

  6. In the address space box in Subnets, select the default subnet.

  7. In Edit subnet, enter or select the following information:

    Setting Value
    Subnet purpose Leave the default Default.
    Name Enter subnet-1.
  8. Leave the rest of the settings as their defaults. Select Save.

    Screenshot of default subnet rename and configuration.

  9. Select Save.

  10. Select Review + create at the bottom of the screen, and when validation passes, select Create.

Delegate a subnet to an Azure service

In this section, you delegate the subnet that you created in the preceding section to an Azure service.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-1.

  4. Select Subnets in Settings.

  5. Select subnet-1.

  6. Enter or select the following information:

    Setting Value
    SUBNET DELEGATION
    Delegate subnet to a service Select the service that you want to delegate the subnet to. For example, Microsoft.Sql/managedInstances.
  7. Select Save.

Remove subnet delegation from an Azure service

In this section, you remove a subnet delegation for an Azure service.

  1. Sign-in to the Azure portal.

  2. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-1.

  4. Select Subnets in Settings.

  5. Select subnet-1.

  6. Enter or select the following information:

    Setting Value
    SUBNET DELEGATION
    Delegate subnet to a service Select None.
  7. Select Save.

When you finish using the resources that you created, you can delete the resource group and all its resources.

  1. In the Azure portal, search for and select Resource groups.

  2. On the Resource groups page, select the test-rg resource group.

  3. On the test-rg page, select Delete resource group.

  4. Enter test-rg in Enter resource group name to confirm deletion, and then select Delete.

Next steps