Map a tenant virtual gateway to its routing subnet and gateway pool

Source facts

A tenant virtual gateway contains network connections such as site-to-site VPN tunnels and may include BGP connections. It links the tenant network with an external network. Microsoft’s procedure first verifies the routing subnet in Network Controller. The new gateway object references both a gateway pool and the subnet used between the gateway and tenant network before the object is added for that tenant. Microsoft documentation.

Applicability

Identify the tenant, external peer, virtual network, routing subnet, gateway pool, and approved connection parameters. Replace every example value with an explicitly reviewed value for the intended deployment.

DSE recommendation

Have the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership. Record which references belong to that tenant and which infrastructure is shared. Define the expected reachable prefixes and the routes that must remain unavailable.

Verification

After approved provisioning, inspect the gateway object’s tenant and subnet references and test the agreed traffic paths. Check routing or tunnel state appropriate to the selected connection type. Include a test of an excluded destination and preserve unexpected reachability as a finding before accepting the connection.

Official references

Microsoft Learn: Add a Virtual Gateway to a Tenant Virtual Network. Source reviewed September 8, 2026.