Azure networking limits cheat sheet
These are the caps Azure publishes for networking resources under the Resource Manager deployment model. The limits apply per region and per subscription, and Microsoft has raised all default networking limits to their maximums — where a limit table has no maximum column, the resource is not adjustable.
The practical consequence: 1,000 VNets per region, 3,000 subnets per VNet, 500 peerings per VNet and 2,000 NSG rules per NSG are the hard ceiling, not a starting point you can raise later. Design within them, because for most rows in the tables below there is no support adjustment to request.
Two separate counting rules matter daily. First, each subnet loses five addresses to the platform reservation (see VNet and subnet sizing), which is unrelated to these limits. Second, the rule limit within a network security group is 2,000 — service tags, application security groups and augmented rules are the documented ways to keep rule counts down.
When reading the tables: everything here is from the Microsoft Learn limits article as published; classic deployment model numbers differ (starting at 100 VNets and 200 rules per NSG) and are listed separately at the bottom.
VNet and subnet limits
| Resource | Limit |
|---|---|
| Virtual networks | 1,000 |
| Subnets per virtual network | 3,000 |
| Virtual network peerings per virtual network | 500 |
| Virtual network gateways (VPN) per virtual network | 1 |
| Virtual network gateways (ExpressRoute) per virtual network | 1 |
| DNS servers per virtual network | 20 |
| DNS servers per network interface | 20 |
| Private IP addresses per virtual network (assigned) | 65,536 |
| Private IP addresses per network interface | 256 |
| Private IP addresses per virtual machine | 256 x N (N = NICs on the VM) |
| Public IP addresses per network interface | 256 |
| Public IP addresses per virtual machine | 256 |
| Network interface cards | 65,536 |
| Concurrent TCP or UDP flows per NIC (VM or role instance) | 500,000 |
NSG, route table and application security group limits
| Resource | Limit |
|---|---|
| Network security groups | 5,000 |
| NSG rules per NSG | 2,000 |
| IP addresses and ranges specified for source or destination in a security rule (limit applies separately to source and destination) | 6,000 |
| Application security groups | 3,000 |
| Application security groups per IP configuration, per NIC | 20 |
| Application security groups referenced as source/destination per NSG rule | 10 |
| IP configurations per application security group | 4,000 |
| Application security groups specified across all rules of one NSG | 600 |
| User-defined route tables | 600 |
| User-defined routes per route table | 1,000 |
| Routes with service tag per route table | 25 |
Default NSG rules
| Rule | Priority | Direction | Action | Details |
|---|---|---|---|---|
| AllowVNetInBound | 65000 | Inbound | Allow | All traffic from the VirtualNetwork service tag |
| AllowAzureLoadBalancerInBound | 65001 | Inbound | Allow | All traffic from the AzureLoadBalancer service tag |
| DenyAllInbound | 65500 | Inbound | Deny | All remaining inbound |
| AllowVnetOutBound | 65000 | Outbound | Allow | All traffic to the VirtualNetwork service tag |
| AllowInternetOutBound | 65001 | Outbound | Allow | All traffic to the Internet service tag |
| DenyAllOutBound | 65500 | Outbound | Deny | All remaining outbound |
Rule attributes per the NSG overview
- Priority
- 100-4096 for custom rules; defaults sit at 65000-65500
- Name
- unique per NSG, up to 80 characters
- Evaluation
- five-tuple (source/source port/destination/destination port/protocol), lowest number wins, processing stops on match
- Statefulness
- stateful: a rule allowing outbound response traffic is not needed for replies; existing flows are unaffected by rule changes
Peering limits and rules
| Item | Limit or rule |
|---|---|
| Peerings per VNet | 500 |
| Total private addresses across a group of peered VNets | 128,000 |
| Transitive peering | Not supported — peer VNetA to VNetC directly |
| Overlapping address spaces | Cannot be peered |
| Bandwidth | No peering-specific limit; bound only by the VM/NIC |
| Bidirectional | Required — one link each way; a one-sided link remains in Initiated state |
| Charges | Peering links are free; data transfer across them is charged |
Public IP address limits
| Resource | Default limit | Maximum |
|---|---|---|
| Basic Public IPv4, IPv6 addresses | 10 | Contact support |
| Standard Public IPv4, IPv6 addresses | 10 | Contact support |
| Public IP prefix length | /28 | Contact support |
| Custom IP prefixes | 5 | Contact support |
Classic model comparison
| Resource | Default limit | Maximum limit |
|---|---|---|
| Virtual networks (classic) | 100 | 100 |
| NSGs (classic) | 200 | 200 |
| NSG rules per NSG (classic) | 200 | 1,000 |
| Private IP addresses per virtual network (classic) | 4,096 | 4,096 |
| DNS servers per virtual network (classic) | 20 | 20 |
FAQ
What is the NSG rule limit in Azure?
2,000 security rules per network security group (Resource Manager), with a separate cap of 6,000 IP addresses or ranges per rule. Network security groups themselves are capped at 5,000 per region per subscription. Six default rules occupy priorities 65000-65500; custom rules must use 100-4096 and can override, but not delete, the defaults.
How many VNets can I have per subscription?
1,000 per region under Resource Manager. Microsoft has raised all networking default limits to their maximums, and this limit has no maximum column in the limits article, so it is not adjustable via a support request.
How many subnets can a virtual network have?
3,000 subnets per virtual network. Subnet ranges cannot overlap each other, and the per-VNet cap on assigned private IPs is 65,536 — so a huge /2-sized address space still only supports 65,536 assigned private IPs per VNet.
Can I request higher limits for networking?
For ARM networking resources, no: the limits article notes all default limits were raised to their maximums, and resources without a maximum column are not adjustable. Some other Azure services expose separate default and maximum columns and can be raised via a no-cost support request. Free trial subscriptions are not eligible for limit increases.
Related tools
- IPv4 subnet calculator — break any CIDR block into network, range, broadcast and usable hosts.
- IP range to CIDR — turn an arbitrary address range into its minimal covering CIDR blocks.
- VLSM calculator — split a block into right-sized subnets by host requirements.