Cloudera Docs

Transitioning from Azure default outbound access

Microsoft is planning to retire the default outbound access connectivity for virtual machines in Azure. You must transition your Cloudera environment on Azure to use an explicit method for outbound internet connectivity while creating any new virtual machines. This ensures enhanced security, predictability, and reliability for your clusters.

In Microsoft Azure (Azure), virtual machines that are created in a virtual network without a defined explicit outbound method were assigned a default implicit outbound public IP address. This IP address enabled outbound connectivity from the resources to the internet. If you have deployed a virtual machine in Azure without explicit outbound connectivity, a default outbound access IP was assigned to the virtual machine.

As previously communicated in Cloudera Customer Advisory-866, the default outbound access connectivity for virtual machines in Azure is retired on 30 September, 2025. After this date, all new virtual machines (new clusters as well as repaired/upgraded cluster nodes) need to use explicit outbound connectivity methods, such as Azure NAT Gateway, Azure Load Balancer outbound rules, or a directly attached Azure public IP address.

The retirement of the default outbound access connectivity will have the following impact:
  • Existing virtual machines that use the default outbound access will continue to work after the retirement date. However, certain operations, such as operating system upgrade, repair, and recover, will break your cluster.
  • New virtual machines created after September 30, 2025, even if deployed into existing VNets and subnets, will not receive default outbound access. These virtual machines must be configured with an explicit outbound method to access the internet.
Cloudera recommends enabling explicit outbound connectivity for your virtual machines using one of the following Microsoft-recommended options, in order of preference:
  • Associate a NAT Gateway with the subnet hosting your Cloudera environment. This is the preferred and most scalable option.
  • Add a Firewall or Network Virtual Appliance (NVA) to your virtual network, and point traffic to the virtual machine using a User Defined Route (UDR).
To assist with this transition, the Cloudera Control Plane displays the following warning message for any cluster that does not use explicit outbound connectivity:
The notification about the transition automatically disappears after one of the explicit outbound connectivity methods is detected for the cluster. As it is your responsibility to configure this connectivity to maintain optimal cluster performance and security, you can also turn off the notification for all affected resources in your account by clicking > Suppress Outbound Warning.
After acknowledging the responsibilities, the warning message will not appear again for the affected resources: