After spending a good amount of time in the Azure documentation. It seems that there is an inconsistency regarding the ability for VMs in the same cloud service (not in a VNet) to talk to each other. Through experience I know that the VMs can talk to each other but it almost seems like not guaranteed behavior.

Virtual Network Overview is especially unhelpful because it says "Do your VMs or cloud services need to communicate with each other within Azure." This make it seem like any two VMs need a VNet to communicate internally. Would it be better to state "VMs in separate cloud services"? Another similar statement is in How to Connect Virtual Machines with a Virtual Network or Cloud Service which was changed a day ago and previously said VMs in a single cloud service could talk to each other.

On the other hand, msdn.microsoft.com/en-us/library/azure/jj156088.aspx implies that intra cloud service communication is possible. azure.microsoft.com/en-us/documentation/articles/virtual-machines-load-balance/ states this too.

It seems to be a possibility that cloud services will eventually have VNets by default and that these inconsistencies may lay some truth to that.

It would be nice to get a final answer on this and have it be documented. Regardless of VNets being a best practice, it's a valid to concern to know if you can communicate between VMs in a cloud service without a VNet on a guaranteed basis. Furthermore, assuming no endpoints exist in the cloud service, are any other outside VMs allowed to talk to the VMs in the service? Experimentation says no which is a nice trade off from Ec2-Classic.

EDIT: I can't post more than 2 links so the two in the "On the other hand" section are poorly formatted. This post was moved from SO.

2 Answers 2


As Trevor explained, VMs within a single cloud service have complete access to all ports on all other VMs within that cloud service (unless firewalls are enabled on a per-VM basis). With web/worker cloud services, you'll need to have internal endpoints set up for communication between role instances (and it doesn't matter whether worker or web).

If you plan on accessing VMs in another cloud service, then you'll need a virtual network. And, if you think you might need to do this, you'll need to set up the virtual network at this point, and add your current VMs to the virtual network. That's because you cannot go back and add a VM to a virtual network after it's been created.

Another advantage to a virtual network: You can specify unchanging internal IP addresses for each VM (which is important for, say, a database cluster configured with a set of known IP addresses).

  • Alright that's what I assumed. It would be nice to get the documentation into a consistent state.
    – edaniels
    Feb 11, 2015 at 15:09

Yes, within the same cloud service, virtual machines can communicate with each other unrestricted. Any restrictions would most likely come from Windows Firewall or some third-party software firewall.

Watch Cheryl McGuire talk about Dynamic IP addresses (DIP) in module #4 "Windows Azure Virtual Network Basics" here: http://www.microsoftvirtualacademy.com/training-courses/windows-azure-iaas-deep-dive-jump-start

enter image description here

For the time being, Azure virtual machines are not required to be deployed into a virtual network, but keep looking to the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.