Microsoft Azure → Amazon Web Services
AWS equivalent of Private subnets (default outbound access off)
The closest AWS equivalents of Private subnets (default outbound access off) are Internet gateway (and egress-only internet gateway) and VPC Block Public Access.
About Private subnets (default outbound access off)
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Subnets with default outbound access turned off, so VMs need an explicit outbound method (NAT Gateway, Standard Load Balancer outbound rules, public IP, or firewall). New virtual networks created with API versions released after March 31, 2026 default to private subnets. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (2)
| Capability | AWS equivalent | Match |
|---|---|---|
| Internet gateway (inbound and outbound internet access) | Internet gateway (and egress-only internet gateway) | Partial match |
| Block internet access at the account level | VPC Block Public Access | Partial match |
Routing & internet access(1)
Internet gateway (inbound and outbound internet access) Partial match
Azure has no internet gateway resource. Resources reach the internet through a public IP, NAT Gateway, load balancer outbound rules, or Azure Firewall. Default outbound access (implicit internet access for VMs) is being phased out with private subnets.
- Control. On AWS, a subnet without a route to an internet gateway has no internet path. On Azure, VMs in older subnets could get implicit default outbound access, which Microsoft is retiring in favor of explicit outbound methods.
- IPv6 egress-only. AWS has an egress-only internet gateway for IPv6. On Azure, use NAT Gateway StandardV2 (IPv6) or NSG rules.
Network security & firewalls(1)
Block internet access at the account level Partial match
VPC Block Public Access has no single Azure switch. The closest combination is private subnets (no default outbound access) plus Azure Policy rules that deny public IPs and internet-facing resources.
- VPC Block Public Access blocks internet gateway traffic for an account and Region in one setting, with exclusions per VPC or subnet. On Azure, the guardrail is assembled from private subnets, policies, NSG or security admin rules, and routing through Azure Firewall.