Azure News - 2026-05-21

Background

Many Azure deployments follow a hub-and-spoke topology: one VNet is designated as the hub and holds the connection to on-premises (via ExpressRoute Gateway, VPN Gateway, or both), and workload VNets — the spokes — peer to the hub to reach on-premises and shared services. This centralizes gateway connectivity so many workloads can share a single ExpressRoute or VPN Gateway.

However, in large hub-and-spoke topologies, ExpressRoute and VPN Gateway limits on advertised prefixes (for example, 1,000 IPv4 and 100 IPv6 prefixes) can be reached. Because each spoke adds its own address prefixes to that count, these limits are approached quickly, constraining how far the topology can scale.

What's New

With Summarized Gateway Prefixes, customers can now advertise a single covering prefix (for example, 10.0.0.0/16) instead of many smaller CIDRs (for example, multiple /24s) – dramatically reducing advertised route count and enabling larger-scale Azure environments.

A new property, summarizedGatewayPrefixes, is now available on the Virtual Network resource in public preview. When configured on a hub VNet, it controls what your ExpressRoute Gateway and VPN Gateway advertise to on-premises, replacing the default behavior of advertising all individual hub and spoke VNet CIDRs with a set of aggregated prefixes you define.

For example, instead of advertising 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24, and so on for each spoke, you can advertise a single 10.0.0.0/16.

Key Benefits

• Fewer advertised routes — Replace hundreds of individual spoke CIDRs with a small set of summarized prefixes.
• Scales with your topology — Supports deployments with 500+ spokes without requiring address plan redesigns or VNet splits.
• IPv4 and IPv6 — Summarize both address families.
• Works with both gateway types — Supported on ExpressRoute Gateway and VPN Gateway.
• Simple configuration — A single property on the VNet resource. No additional services or dependencies.
• Backward compatible — If the property is left empty, behavior is unchanged: all hub and peered spoke address spaces are advertised as before.

How It Works

Default behavior

ExpressRoute Gateway and VPN Gateway advertise all address spaces of the hub VNet and all address spaces of peered spoke VNets to on-premises.

With summarizedGatewayPrefixes configured

1. The gateways advertise the summarized prefixes instead of the hub VNet's individual address spaces.
2. For each peered spoke, if the spoke's address space falls within a summarized prefix, the spoke's individual CIDRs are suppressed from advertisement.

3. Spoke address spaces not covered by a summarized prefix continue to be advertised individually.

Example:

Getting Started

1. Open the hub VNet (the VNet containing your GatewaySubnet) in the Azure portal.
2. Go to Address space → Advertised gateway prefixes.
3. Add one or more IPv4 or IPv6 CIDR prefixes that cover the address spaces you want to summarize.

4. Navigate to your virtual network and verify that the summarized prefixes appear.
   

Things to Know

• The property is set on the hub VNet (the VNet with the GatewaySubnet).
• The summarized prefixes list can include prefixes outside the VNet's own address space.
• Avoid overlap among prefixes within the list, but overlap with peered VNet address spaces is expected in hub-and-spoke designs.
• For dual-stack (IPv4 + IPv6) VNets, define both IPv4 and IPv6 summarized prefixes explicitly.