Microsoft cloud
Azure network connection
Azure network connection is a Windows 365 configuration object, commonly abbreviated ANC, that defines how Cloud PCs provisioned in Enterprise-mode Windows 365 join an organisation's own Azure virtual network rather than running on network infrastructure Microsoft manages entirely on the organisation's behalf.
Why Azure network connection matters in a Microsoft estate
Azure network connection matters because Microsoft 365, Azure, Windows 365, Teams, and related services are usually managed as one estate. The term connects to planning, cost, configuration, security, and day-two operational decisions across that estate.
How Azure network connection shows up in practice
It specifies the target Azure subscription, resource group, virtual network, and subnet that new Cloud PCs will be attached to, along with the Active Directory join type the Cloud PC should use: Microsoft Entra join for cloud-native identity, or hybrid Microsoft Entra join. Hybrid Microsoft Entra join additionally requires line-of-sight network connectivity back to an on-premises or Azure-hosted domain controller so the Cloud PC can complete a traditional Active Directory domain join alongside its Entra registration. This distinction is the reason ANCs exist at all: Windows 365 Enterprise offers two provisioning models. The first, Microsoft-hosted network, has Microsoft handle all networking, and the Cloud PC has no direct route into the organisation's own virtual network.
The second, Azure network connection, deploys the Cloud PC directly inside the organisation's virtual network, so it can reach internal resources like file servers, line-of-business applications, printers, or domain controllers exactly as a traditional on-premises or VPN-connected device would. Organisations with hybrid Active Directory environments, internal resources not exposed to the public internet, or specific network security and compliance requirements that mandate traffic stay within an organisation-controlled network boundary generally have no choice but to use an Azure network connection. Organisations that are natively cloud-first and have no on-premises dependencies can often use the simpler Microsoft-hosted network model instead, and skip ANC configuration, VNet peering, and subnet capacity planning entirely. Before an ANC can be used in a provisioning policy, Microsoft runs a health check against it covering domain join credentials, DNS resolution, network connectivity, and required outbound endpoints.
A failed health check is one of the most common reasons a Windows 365 provisioning policy silently fails to create Cloud PCs, so ANC health status is one of the first things to check when new Cloud PC provisioning stalls. Subnet sizing is a frequently underestimated planning detail: each Cloud PC consumes an IP address from the assigned subnet for its lifetime. An organisation provisioning at scale, or planning for Cloud PC resize and reprovisioning operations that can temporarily require additional addresses, needs a subnet sized with meaningful headroom rather than the minimum current headcount. Running out of subnet capacity blocks new Cloud PC provisioning entirely until the network is resized or a new subnet is added.