# Keep all NIC subnets in one virtual network when designing a Windows Azure VM

> DSE recommends drawing each NIC-to-subnet relationship and recording the common virtual network before selecting the VM size.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-170-keep-all-nic-subnets-in-one-virtual-network-when-designing-a-windows-azure-vm/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:10+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends drawing each NIC-to-subnet relationship and recording the common virtual network before selecting the VM size.

## Potentially affected

Use this review when a Windows Azure VM design calls for separate front-end and back-end subnets or an additional network interface on an existing machine.

## DSE recommendation

DSE recommends drawing each NIC-to-subnet relationship and recording the common virtual network before selecting the VM size.

## Article

## Source facts

Microsoft’s multi-NIC Windows VM guide requires all attached NIC subnets to belong to the same virtual network. The supported number of NICs depends on the VM size. Adding a NIC to an existing VM requires deallocating it before attachment and starting it afterward. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/multiple-nics)

## Applicability

Use this review when a Windows Azure VM design calls for separate front-end and back-end subnets or an additional network interface on an existing machine.

## DSE recommendation

DSE recommends drawing each NIC-to-subnet relationship and recording the common virtual network before selecting the VM size. Verify the intended interface count and decide which NIC is primary. For an existing VM, have the workload owner approve the deallocation window and recovery approach. Include the required guest routing review in the implementation plan, and avoid treating a NIC attachment as proof that the intended application traffic path is ready.

## Verification

Inspect the deployed NICs, subnet identifiers, VM size, and primary-interface designation against the approved diagram. After the authorized restart, check the guest routes and test each intended application path. Record any unexpected path or connectivity result and resolve it before declaring the additional interface operational.

## Official references

- [Microsoft: Create and manage Windows VMs in Azure that use multiple NICs – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/multiple-nics)

## Primary reference

- Name: Create and manage Windows VMs in Azure that use multiple NICs - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/multiple-nics
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep all NIC subnets in one virtual network when designing a Windows Azure VM,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-170-keep-all-nic-subnets-in-one-virtual-network-when-designing-a-windows-azure-vm/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.