azure-virtual-wan

name	azure-virtual-wan
description	Expert knowledge for Azure Virtual WAN development including troubleshooting, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when designing Virtual WAN hubs, P2S VPN, ExpressRoute/SD‑WAN connectivity, NVAs/firewalls, or Entra ID VPN access, and other Azure Virtual WAN related development tasks. Not for Azure Virtual Network (use azure-virtual-network), Azure VPN Gateway (use azure-vpn-gateway), Azure ExpressRoute (use azure-expressroute), Azure Traffic Manager (use azure-traffic-manager).
compatibility	Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata	{"generated_at":"2026-04-05","generator":"docs2skills/1.0.0"}

Azure Virtual WAN Skill

This skill provides expert guidance for Azure Virtual WAN. Covers troubleshooting, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L36-L41	Diagnosing and fixing Virtual WAN issues, including P2S VPN client prerequisite checks, connectivity problems, and using built-in tools and diagnostics for troubleshooting.
Decision Making	L42-L47	Guidance on when/how to upgrade Virtual WAN from Basic to Standard, and how to choose Virtual WAN partners and hub locations for your network design.
Architecture & Design Patterns	L48-L73	Designing Virtual WAN hub-and-spoke, routing, and security patterns: NVA/Azure Firewall paths, VNet/branch isolation, SD‑WAN/ExpressRoute/M365 connectivity, DR, and global transit architectures.
Limits & Quotas	L74-L79	P2S VPN client IP pool sizing, scale limits, and Virtual WAN hub routing capabilities, throughput caps, and performance constraints
Security	L80-L92	Configuring secure P2S VPN access in Virtual WAN using Microsoft Entra ID (MFA, custom/segmented app registrations, Azure VPN Client) and managing hub roles/permissions.
Configuration	L93-L144	Configuring Virtual WAN hubs, routing, BGP, NVAs, firewalls, IPsec/NAT, and setting up/issuing P2S/Always On VPN client profiles, certificates, and Entra ID-based VPN access
Integrations & Coding Patterns	L145-L152	PowerShell and automation patterns for integrating Virtual WAN with ExpressRoute, SD-WAN/VPN CPEs, RADIUS user groups, and sharing services via Azure Private Link
Deployment	L153-L157	PowerShell-based deployment of cross-tenant VNet connections to Virtual WAN hubs and step-by-step setup of integrated NVAs inside Virtual WAN hubs.

Troubleshooting

Topic	URL
Use Azure VPN Client prerequisites check for P2S	https://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-prerequisites-check
Troubleshooting tools and diagnostics for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-troubleshooting-overview

Decision Making

Topic	URL
Decide and perform upgrade from Basic to Standard Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/upgrade-virtual-wan
Select Azure Virtual WAN partners and hub locations	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-locations-partners

Architecture & Design Patterns

Topic	URL
Routing intent patterns to secure internet access	https://learn.microsoft.com/en-us/azure/virtual-wan/about-internet-routing
Use Network Virtual Appliances inside Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/about-nva-hub
Choose routing preference in Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing-preference
Design disaster recovery architecture for Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/disaster-recovery-design
Architect China interconnect using Virtual WAN secured hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/interconnect-china
Migrate hub-and-spoke networks to Azure Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology
Deep dive into Azure Virtual WAN routing behavior	https://learn.microsoft.com/en-us/azure/virtual-wan/routing-deep-dive
Connect Microsoft 365 via ExpressRoute private peering in Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-365-expressroute-private
Implement any-to-any routing with Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-any-to-any
Configure BGP peering with Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-bgp-peering-hub
Isolate VNets and branches with Virtual WAN and Azure Firewall	https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-isolate-virtual-networks-branches

Limits & Quotas

Topic	URL
Plan P2S client address pools and scale for Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/about-client-address-pools
Virtual hub routing capabilities and throughput limits	https://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing

Security

Topic	URL
Secure P2S client access to spoke VNets with Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/manage-secure-access-resources-spoke-p2s
Enable Microsoft Entra multifactor authentication for VPN users	https://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-mfa
Configure a Microsoft Entra tenant for Virtual WAN P2S OpenVPN	https://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-tenant
Configure multiple Entra apps for segmented P2S VPN access	https://learn.microsoft.com/en-us/azure/virtual-wan/openvpn-azure-ad-tenant-multi-app
Migrate P2S VPN to Microsoft-registered Azure VPN Client app	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-gateway-update
Create custom Entra app IDs for P2S VPN authentication	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-register-custom-app
Configure Azure VPN Client for P2S with Microsoft Entra ID	https://learn.microsoft.com/en-us/azure/virtual-wan/point-to-site-entra-vpn-client-windows
Assign roles and permissions for Azure Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/roles-permissions
Configure P2S User VPN with Microsoft Entra ID authentication	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-point-to-site-azure-ad

Configuration

Topic	URL
Work with Azure Virtual WAN User VPN client profiles	https://learn.microsoft.com/en-us/azure/virtual-wan/about-vpn-profile-download
Configure optional Azure VPN Client OpenVPN settings	https://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-optional-configurations
Azure VPN Client version and feature reference	https://learn.microsoft.com/en-us/azure/virtual-wan/azure-vpn-client-versions
Generate P2S User VPN certificates using PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/certificates-point-to-site
Generate P2S User VPN certificates using MakeCert	https://learn.microsoft.com/en-us/azure/virtual-wan/certificates-point-to-site-makecert
Configure BGP peering to NVA in Virtual WAN hub	https://learn.microsoft.com/en-us/azure/virtual-wan/create-bgp-peering-hub-portal
Configure BGP peering from Virtual WAN hub to NVA (PowerShell)	https://learn.microsoft.com/en-us/azure/virtual-wan/create-bgp-peering-hub-powershell
View effective routes for a Virtual WAN hub	https://learn.microsoft.com/en-us/azure/virtual-wan/effective-routes-virtual-hub
Configure and understand Virtual WAN gateway settings	https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings
Configure forced tunneling for Virtual WAN P2S VPN	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-forced-tunnel
Manage IP configurations for NVAs in Virtual WAN hubs	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-network-virtual-appliance-add-ip-configurations

Integrations & Coding Patterns

Topic	URL
Create ExpressRoute associations to Virtual WAN via PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/expressroute-powershell
Share Azure Private Link services via Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/howto-private-link
Configure RADIUS VSAs for Virtual WAN user groups	https://learn.microsoft.com/en-us/azure/virtual-wan/user-groups-radius
Automate SD-WAN and VPN CPE integration with Virtual WAN	https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-configure-automation-providers

Deployment

Topic	URL
Connect cross-tenant VNets to Virtual WAN hubs with PowerShell	https://learn.microsoft.com/en-us/azure/virtual-wan/cross-tenant-vnet
Deploy an integrated NVA in an Azure Virtual WAN hub	https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-nva-hub