MSDEVBUILD / azure

Virtual Network Peering

Internet Office VNet 10.0.0.0/16 web subnet data subnet ✓NSG LOAD BAL. VNet 2 🗄️Storage (PaaS) Azure DNS Peering connects two virtual networks over Microsoft’s private backbone
Peering is a private gate between two networks. Traffic runs over Microsoft’s own cables, never the internet.

😟 THE PROBLEM

Two Azure networks need to talk, but data must not cross the public internet.

😊 THE SOLUTION

Peer the virtual networks over the Microsoft backbone.

  • Networks in different regions✓ Global peering connects them
  • Gateways add latency✓ Peering is direct and fast
  • Traffic on the internet✓ Stays on Microsoft’s backbone
🛠️ Solved with: VNet peering
Module 2: Architecture & Services ⏱ 5 min read Updated 11 Nov 2026

Quick answer

Virtual network peering connects two Azure virtual networks so resources in both can communicate using private IP addresses. Traffic travels over Microsoft's private backbone network, never the public internet. Peering works within a region and across regions (global peering).

Exam objective: 2.2.5 Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute. (Skills measured as of July 20, 2026)

Start with a question

Your app’s network is in West Europe and your data platform is in North Europe. How do they talk privately?

You peer the two virtual networks. They connect over Microsoft’s own private cables.

Explain it like I’m 10

The technical explanation

Peering links two VNets so resources communicate with private IPs, low latency and high bandwidth. Regional peering joins VNets in one region; global peering joins VNets in different regions. Traffic stays on the Microsoft backbone. Peering is non-transitive and requires non-overlapping address spaces.

Real-world business scenario

Healthcare

A healthcare analytics company

The problem
The patient app in one VNet needed to query an analytics platform in another region, and the data could not cross the public internet.
What they used
Global VNet peering between the two VNets.
Why that choice
Private, encrypted-in-transit backbone connectivity with no gateways to manage.
The result
Low-latency private queries between regions, satisfying the security review.

When to use it and when not to

✓ Use it when…

  • Connecting VNets in Azure privately.
  • Hub-and-spoke designs with shared services.

✕ Think twice when…

  • Connecting on-premises networks. Use VPN Gateway or ExpressRoute for that.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is VNet peering?

Model answer

It connects two Azure virtual networks so they behave like one network for traffic between them. It is private, fast and uses Microsoft's backbone, not the internet.

Intermediate Is peering transitive?

Model answer

No. If VNet A is peered with B, and B with C, A and C cannot talk unless they are peered directly or traffic goes through a hub with routing, for example a firewall or Virtual WAN hub.

Experienced developer When would you use a hub-and-spoke design with peering?

Model answer

When many workload VNets (spokes) need shared services such as a firewall, VPN or ExpressRoute gateway and DNS in a central hub. Spokes peer to the hub, use gateway transit and route through the firewall. At larger scale, Azure Virtual WAN can manage the hub for you.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Two Azure VNets in different regions must communicate privately over the Microsoft backbone. What should you use?

Question 2

Question 2 of 3

VNet A is peered to B, and B is peered to C. Can A talk to C directly?

Question 3

Question 3 of 3

Does traffic between peered VNets travel over the public internet?

Quick revision

Key points

  • Peering connects VNets privately.
  • Traffic uses Microsoft's backbone, not the internet.
  • Works in the same region and across regions (global peering).
  • Peering is non-transitive.

Important terminology

VNet peering
A private connection between two virtual networks.
Global VNet peering
Peering between virtual networks in different Azure regions.
Non-transitive
If A peers with B and B with C, A cannot reach C unless A and C are also peered (or a hub routes the traffic).

Common mistakes

  • Assuming peered VNets can overlap in address space. They cannot.

Exam tips

  • "Connect two Azure VNets privately over the Microsoft backbone" = VNet peering.

Five quick revision questions

  1. 1.What does VNet peering connect?Show

    Two Azure virtual networks.

  2. 2.Does peered traffic cross the public internet?Show

    No, it uses Microsoft's backbone.

  3. 3.What is global peering?Show

    Peering between VNets in different regions.

  4. 4.Is peering transitive?Show

    No.

  5. 5.Can peered VNets have overlapping address spaces?Show

    No.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Network Security Groups