Virtual WAN: how to advertise only selected subnet prefixes from a spoke VNet (not the full VNet address space)?

Question

Virtual WAN: how to advertise only selected subnet prefixes from a spoke VNet (not the full VNet address space)?

Anupriya Kathpalia 0

We attach customer spoke VNets to a Virtual Hub using hubVirtualNetworkConnections. Each spoke VNet contains both connectivity member subnets (workloads that should participate in a connectivity domain) and non-member subnets (e.g. mgmt/WAF) that must not be reachable from other regions/spokes in that network.

Observed behavior

After connecting a spoke (example: VNet address space 13.11.0.0/24 with member subnet 13.11.0.16/28 and non-member 13.11.0.0/28), the hub effective routes show the entire VNet address space via the Virtual Network Connection—not only the member subnet. Remote hubs/spokes therefore learn a covering prefix that includes non-member subnets.

We already use a per-domain custom hub route table (association + label propagation, not defaultRouteTable) for isolation between domains. That does not solve within-VNet subnet isolation, because Azure still injects the full addressSpace.

What we are trying to achieve

Remote regions learn only member subnet CIDRs (CIDR lengths vary; not always /28).
Non-member subnets in the same VNet are not reachable cross-region via the hub.
Same-domain member ↔ member connectivity across regions must still work.

Prefer a supported, maintainable pattern (ARM/Bicep/Terraform/Crossplane-friendly).

What we are trying to achieve

Remote regions learn only member subnet CIDRs (CIDR lengths vary; not always /28).
Non-member subnets in the same VNet are not reachable cross-region via the hub.
Same-domain member ↔ member connectivity across regions must still work.
Prefer a supported, maintainable pattern (ARM/Bicep/Terraform/Crossplane-friendly).

1.Is there a supported way to prevent a Virtual Hub from learning a spoke’s full addressSpace and instead learn only selected subnet prefixes?

If association to the custom route table remains, do all subnets in the spoke still learn remote hub routes (so non-members need UDR/NSG for outbound isolation even when propagation is none)?
What is Microsoft’s recommended design for “only these subnets in a VNet participate in Virtual WAN connectivity” without putting each member subnet in its own VNet?

0 comments

1 answer

Your answer

Answer 1

Hello @Anupriya Kathpalia

What you're seeing is expected Virtual WAN behavior. When a VNet connects to a virtual hub, Azure learns the VNet address space as system routes; the VNet connection doesn't support advertising only selected workload subnet prefixes. It automatically learns these system routes when you create the spoke connection.

Also, association and propagation solve different problems. Setting propagation to None prevents that connection's routes from being propagated to other hub route tables; it doesn't provide subnet-level participation within the connected VNet.

Therefore, if some subnets must participate in Virtual WAN connectivity while other subnets must remain isolated, the cleanest supported design is generally to place those workloads in separate VNets/connections. Otherwise, enforce the required isolation inside the existing VNet using UDRs/NSGs/NVA or firewall controls rather than relying on Virtual WAN route propagation alone.

The vnetRoutes/staticRoutes properties on hubVirtualNetworkConnections don't change this behavior. They're meant primarily to steer traffic through an NVA in the spoke, not to filter which native VNet prefixes Virtual WAN learns.

References:

Connect a VNet to a Virtual WAN hub

About Virtual Hub routing

Help make this community better for everyone: if this answer resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution.