1---2name: azure-networking3description: Expert knowledge for Azure Networking development including troubleshooting, best practices, decision making, architecture & design patterns, security, and configuration. Use when designing VNets/VWAN, hub-spoke, Azure Firewall/WAF, DDoS/NSG policies, or fixing Microsoft.Network issues, and other Azure Networking related development tasks. Not for Azure Virtual Network (use azure-virtual-network), Azure Virtual Network Manager (use azure-virtual-network-manager), Azure Virtual WAN (use azure-virtual-wan), Azure Network Watcher (use azure-network-watcher).4---5# Azure Networking Skill
6
7This skill provides expert guidance for Azure Networking. Covers troubleshooting, best practices, decision making, architecture & design patterns, security, and configuration. It combines local quick-reference content with remote documentation fetching capabilities.
8
9## How to Use This Skill
10
11> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file
12
13> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)
14
15This skill requires **network access** to fetch documentation content:
16- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
17- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.
18
19## Category Index
20
21| Category | Lines | Description |
22|----------|-------|-------------|
23| Troubleshooting | L34-L39 | Diagnosing and resolving Azure network resource issues, including monitoring, troubleshooting connectivity/performance, and fixing failed Microsoft.Network provisioning states. |
24| Best Practices | L40-L44 | Guidance on boosting Azure NVA/VM network throughput and latency using Accelerated Connections, including configuration steps and performance optimization best practices. |
25| Decision Making | L45-L62 | Guidance on choosing Azure network architectures and services (load balancing, DDoS, firewall/WAF, hybrid/multicloud, private access, egress/ingress) for specific deployment scenarios. |
26| Architecture & Design Patterns | L63-L75 | Designing secure Azure network topologies (hub-spoke, flat, multi-region, Virtual WAN), planning IP addressing/subnets, and applying common workload-specific networking patterns. |
27| Security | L76-L90 | Designing and enforcing network security in Azure: firewalls, WAF, NSGs/ASGs, secure DNS, DDoS protection, and applying Zero Trust and policy compliance to all network paths. |
28| Configuration | L91-L95 | Configuring and centrally managing virtual networks with Virtual Network Manager, and enforcing/using built-in Azure Policy definitions for networking resources. |
29
30### Troubleshooting
31| Topic | URL |
32|-------|-----|
33| Monitor and troubleshoot Azure network resources | https://learn.microsoft.com/en-us/azure/networking/design-guide/monitor |
34| Diagnose failed Microsoft.Network provisioning states | https://learn.microsoft.com/en-us/azure/networking/troubleshoot-failed-state |
35
36### Best Practices
37| Topic | URL |
38|-------|-----|
39| Optimize NVA and VM performance with Accelerated Connections | https://learn.microsoft.com/en-us/azure/networking/nva-accelerated-connections |
40
41### Decision Making
42| Topic | URL |
43|-------|-----|
44| Use Azure region latency stats for deployment planning | https://learn.microsoft.com/en-us/azure/networking/azure-network-latency |
45| Choose the right Azure load balancing service | https://learn.microsoft.com/en-us/azure/networking/design-guide/app-delivery |
46| Plan cross-cloud connectivity with Azure networking | https://learn.microsoft.com/en-us/azure/networking/design-guide/cross-cloud |
47| Plan cross-region and multicloud connectivity in Azure | https://learn.microsoft.com/en-us/azure/networking/design-guide/cross-region |
48| Select the right Azure DDoS protection tier | https://learn.microsoft.com/en-us/azure/networking/design-guide/ddos |
49| Plan Azure hybrid connectivity with VPN or ExpressRoute | https://learn.microsoft.com/en-us/azure/networking/design-guide/hybrid-connectivity |
50| Select Azure services for internet ingress | https://learn.microsoft.com/en-us/azure/networking/design-guide/internet-ingress |
51| Plan lift-and-shift Azure network designs | https://learn.microsoft.com/en-us/azure/networking/design-guide/lift-and-shift |
52| Design networks for migrate-and-modernize workloads | https://learn.microsoft.com/en-us/azure/networking/design-guide/migrate-modernize |
53| Control outbound internet egress from Azure VNets | https://learn.microsoft.com/en-us/azure/networking/design-guide/outbound-egress |
54| Select private access options for Azure PaaS | https://learn.microsoft.com/en-us/azure/networking/design-guide/private-platform-as-a-service |
55| Select secure application delivery services in Azure | https://learn.microsoft.com/en-us/azure/networking/secure-application-delivery |
56| Choose a secure Azure network topology for workloads | https://learn.microsoft.com/en-us/azure/networking/secure-network-topology |
57| Choose between Azure Firewall, DDoS Protection, and WAF | https://learn.microsoft.com/en-us/azure/networking/security/network-security |
58
59### Architecture & Design Patterns
60| Topic | URL |
61|-------|-----|
62| Deploy a Zero Trust virtual network for Azure web apps | https://learn.microsoft.com/en-us/azure/networking/create-zero-trust-network-web-apps |
63| Design a secure hub-spoke network for Azure web apps | https://learn.microsoft.com/en-us/azure/networking/cross-service-scenarios/design-secure-hub-spoke-network |
64| Implement a single-workload flat VNet topology | https://learn.microsoft.com/en-us/azure/networking/design-guide/flat-network |
65| Design hub-and-spoke network topology in Azure | https://learn.microsoft.com/en-us/azure/networking/design-guide/hub-spoke |
66| Plan IP addressing for Azure virtual networks | https://learn.microsoft.com/en-us/azure/networking/design-guide/ip-planning |
67| Design multi-region Azure network architectures | https://learn.microsoft.com/en-us/azure/networking/design-guide/multi-region |
68| Architect global transit networks with Azure Virtual WAN | https://learn.microsoft.com/en-us/azure/networking/design-guide/virtual-wan |
69| Design Azure virtual networks and subnet layouts | https://learn.microsoft.com/en-us/azure/networking/design-guide/vnets-subnets |
70| Apply common Azure networking workload patterns | https://learn.microsoft.com/en-us/azure/networking/design-guide/workload-patterns |
71
72### Security
73| Topic | URL |
74|-------|-----|
75| Design Azure Firewall tiers and traffic inspection | https://learn.microsoft.com/en-us/azure/networking/design-guide/azure-firewall |
76| Secure developer and admin access to Azure VMs | https://learn.microsoft.com/en-us/azure/networking/design-guide/developer-admin-access |
77| Design secure DNS and private name resolution in Azure | https://learn.microsoft.com/en-us/azure/networking/design-guide/dns-security |
78| Secure Azure VNets with NSGs and ASGs | https://learn.microsoft.com/en-us/azure/networking/design-guide/network-application-security-groups |
79| Protect web apps with Azure Web Application Firewall | https://learn.microsoft.com/en-us/azure/networking/design-guide/web-application-firewall |
80| Apply Azure Policy compliance controls to networking | https://learn.microsoft.com/en-us/azure/networking/security-controls-policy |
81| Apply Zero Trust to Application Gateway WAF | https://learn.microsoft.com/en-us/azure/networking/security/zero-trust-application-gateway-waf |
82| Implement Zero Trust with Azure Firewall | https://learn.microsoft.com/en-us/azure/networking/security/zero-trust-azure-firewall |
83| Harden Azure DDoS Protection with Zero Trust | https://learn.microsoft.com/en-us/azure/networking/security/zero-trust-ddos-protection |
84| Secure Azure Front Door WAF using Zero Trust | https://learn.microsoft.com/en-us/azure/networking/security/zero-trust-front-door-waf |
85| Apply Zero Trust to Azure network security | https://learn.microsoft.com/en-us/azure/networking/security/zero-trust-network-security |
86
87### Configuration
88| Topic | URL |
89|-------|-----|
90| Manage Azure VNets centrally with Virtual Network Manager | https://learn.microsoft.com/en-us/azure/networking/design-guide/azure-virtual-network-manager |
91| Use built-in Azure Policy for networking services | https://learn.microsoft.com/en-us/azure/networking/policy-reference |
microsoftdocs