Hey everyone, as Microsoft is retiring default outbound Internet access for new Azure VMs after Sept 30, 2025 (see https://azure.microsoft.com/en-us/updates/?id=default-outbound-access-for-vms-in-azure-will-be-retired-updates-and-more-information ). we are looking for the best solution to solve that. I know the official options ( https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access ) → NAT Gateway, Standard Load Balancer with outbound rules, or Public IP. Public IP is not an option for us. What’s the simplest and most cost-effective approach you guys are using? NAT Gateway or LB outbound rules? And why? Thanks!

NAT Gateway with private subnets and NSGs that block recommend outbound protocols (Telnet, SMB, DNS etc). Uses IPv4 and prevents IPv6 outbound (which would require the LB). Simplest and most cost effective but perhaps doesn’t give you as much control as Azure Firewall

so this means I need NAT Gateway AND an LB

No, just NAT gateway

NAT Gateway for most, but many of ours are hub/spoke already with UDRs going out NVAs in the transit network.

I would recommend NAT GW as well... Easy to rollout