Map container endpoint addresses onto an SDN tenant subnet

Source facts

Microsoft’s procedure uses the l2bridge network driver, with l2tunnel as another option, for container networks within a tenant VM. For these SDN drivers, container endpoints occupy the same virtual subnet as the tenant VM that hosts them. The Host Networking Service assigns endpoint addresses through the private-cloud plugin. The endpoints have distinct IP addresses but share their host VM’s MAC address because Layer-2 address translation is used. Microsoft documentation.

Applicability

Check the existing tenant network, subnet, VM NIC resource, container host, and documented software prerequisites. Treat the source’s sample addresses as examples and substitute only addresses approved for the actual tenant subnet.

DSE recommendation

Prepare an endpoint allocation worksheet before configuring the host. Identify the tenant network, container address range, responsible network controller, and expected isolation boundary. Review the relationship between endpoint IP identities and the shared MAC identity with the operators who will investigate connectivity.

Verification

Create a controlled endpoint and compare its assigned address with the approved range and tenant subnet. Test its allowed connections and isolation from a separate tenant. Preserve the controller, host, and container observations together so address allocation and policy enforcement can be assessed for the same endpoint.

Official references

Microsoft Learn: Connect container endpoints to a tenant virtual network. Source reviewed September 8, 2026.