Beyond Hub and Spoke Azure Networks for Growing Australian Firms

In this blog post Beyond Hub and Spoke Azure Networks for Growing Australian Firms we will explain why a network design that worked when Azure held two applications can become expensive, slow and difficult to manage as the business grows.

The problem often appears gradually. New applications, offices, cloud subscriptions and security tools are added, but the underlying network remains unchanged. Eventually, every connection passes through one central point, costs become harder to explain, and a small routing change can affect half the business.

Hub-and-spoke is not a bad design. It is still an excellent choice for many organisations. The important question is whether it remains the right choice for your size, locations, traffic patterns and risk profile.

What an Azure network design actually does

An Azure network design determines how applications, users, offices and cloud services communicate. Think of it as the road system connecting your digital operations.

Azure Virtual Networks, commonly called VNets, are private network areas for your cloud systems. Routing rules decide where information travels, while services such as Azure Firewall inspect traffic and block unwanted connections.

In a traditional hub-and-spoke design, the hub contains shared services such as firewalls, private connectivity and domain name services. Each spoke contains a business application or environment and connects back to the hub. The arrangement provides central control without placing every system in one network.

This model becomes less efficient when applications need to communicate frequently across spokes, the business operates in several regions, or the IT team is maintaining a growing collection of routes and network connections.

Choice one Keep the traditional hub-and-spoke model

For an organisation operating mainly in one Azure region with a manageable number of workloads, traditional hub-and-spoke may still be the simplest and most economical option.

It gives the IT team one place to control internet access, connections to offices and security inspection. Workloads can remain separated, reducing the risk that a problem in a test environment spreads into production.

The warning sign is excessive centralisation. If all communication between trusted applications must travel through an expensive firewall, the business may pay unnecessary data processing charges while adding delay.

Traditional hub-and-spoke is usually appropriate when:

• Most Azure systems operate in one region.
• The number of networks and subscriptions remains modest.
• Traffic between separate applications is limited.
• A small central team manages network changes.
• The business needs predictable control more than global scale.

Do not replace a simple design merely because a newer service exists. Added complexity should solve a measurable business problem.

Choice two Manage growth with Azure Virtual Network Manager

Azure Virtual Network Manager helps organisations manage connectivity and security rules across many Azure networks from one place. Instead of manually configuring every connection, the IT team can group networks by purpose and apply an approved design consistently.

For example, production networks can automatically receive one set of connectivity rules while development networks receive another. New networks can also be added to the correct group based on company policy, reducing configuration mistakes as Azure expands.

Virtual Network Manager supports hub-and-spoke and mesh arrangements. A mesh allows selected networks to connect directly rather than sending all traffic through the hub.

This does not mean every application should communicate freely. Direct connectivity should be limited to systems with a genuine performance, availability or cost requirement.

The business outcome is controlled growth. Your team spends less time maintaining individual connections, while central rules reduce the chance that a rushed project creates an unmonitored path into sensitive systems.

Choice three Use Azure Virtual WAN for broader connectivity

Azure Virtual WAN is designed for organisations connecting multiple offices, remote users, Azure regions and private networks. Microsoft operates much of the underlying routing platform, reducing the amount of network infrastructure your team must build and maintain.

It can bring private office connections, remote-access VPNs, Azure networks and central security controls into one managed service. Routing intent can also direct private or internet-bound traffic through an approved firewall automatically.

Virtual WAN becomes attractive when a business has several locations, is expanding internationally, or needs reliable connectivity across multiple Azure regions. It can replace a collection of separately managed gateways and complicated routing tables.

However, it is not automatically cheaper. There are service, connection and data-processing costs to consider. A five-office organisation with modest cloud use should not adopt an enterprise-scale design without modelling the likely bill.

The value comes from reducing operational effort and failure risk. Paying more for a managed service can make sense if it removes fragile network components that only one employee understands.

Choice four Build regional hubs or network stamps

A single hub can become a business dependency. If it has a configuration issue, capacity problem or regional outage, many applications may be affected at once.

Growing organisations can instead use separate hubs or repeatable network “stamps” in different Azure regions. A stamp is a standard network pattern that can be deployed again with the same security, monitoring and routing controls.

This approach is useful when applications have different availability requirements. A customer platform may need regional resilience, while an internal reporting system can remain in one location to control costs.

The network design must align with the recovery plan. A secondary application environment is of little value if its network, name resolution or security services still depend on the primary region.

This extends the resilience planning covered in how Australian mid-market firms build stronger Azure resilience. Recovery should be tested as an end-to-end business service, not treated as a collection of backup files.

Choice five Use a mixed design based on business risk

Many organisations do not need to choose one network model for everything. A mixed design can keep central controls while allowing carefully selected exceptions.

For example, sensitive finance systems may send all traffic through a central firewall. Two trusted application networks may connect directly for performance, while branches and remote users connect through Virtual WAN.

Cloud services can also use private endpoints, which provide a private network address for services such as Azure storage or databases. This can reduce public internet exposure, although it introduces planning requirements around name resolution and access control.

The same principle matters for employee platforms. If Azure Virtual Desktop is part of the environment, storage placement and network paths can directly affect login times and user experience. We explore those dependencies in Azure Files for AVD hybrid design choices.

A common mid-market scenario

Consider a composite example based on patterns regularly seen in growing organisations. A 200-person company started with one Azure subscription, one hub and three application spokes.

After several years, it had more than 20 networks across production, testing, data analytics and customer platforms. Every network used manually maintained connections and routes, while most traffic passed through the same firewall.

The company did not need to discard hub-and-spoke. It introduced Virtual Network Manager to apply consistent connectivity, allowed direct connections for two high-volume application paths, and created a separate regional hub for critical services.

The result was a simpler operating model, fewer manual changes and less unnecessary firewall processing. More importantly, the company could add new workloads without redesigning the network each time.

Questions to answer before changing the design

1. Where will the business operate in three years? Include offices, remote workers, acquisitions and international expansion.
2. Which systems communicate most often? Actual traffic patterns are more useful than an attractive architecture diagram.
3. What must keep running during an outage? Not every workload needs the same level of resilience.
4. Which traffic genuinely requires central inspection? Sending everything through every security tool can increase cost without reducing risk.
5. Who will operate the design? A sophisticated network that your team cannot confidently support is a business liability.
6. What is the full cost? Include data transfer, firewall processing, gateways, monitoring and staff time.

Network architecture also supports cybersecurity and compliance, but it does not create compliance by itself. Segmentation and controlled connectivity can limit the impact of an incident and support the Essential Eight, the Australian Government’s cybersecurity framework, but identity, patching, backups and application controls still matter.

Choose for the business you are becoming

The right Azure network is not necessarily the newest or most elaborate. It is the one that gives the business enough security, resilience and room to grow without creating unnecessary cost or operational burden.

CloudProInc approaches these decisions with more than 20 years of enterprise IT experience across Azure, Microsoft security and modern cloud operations. As a Microsoft Partner and Wiz Security Integrator, our Melbourne-based team can assess both the network design and the security risks surrounding it.

If your Azure environment has grown faster than its original network plan, or nobody can clearly explain the routes, dependencies and monthly costs, we are happy to take a practical look with you — no strings attached.