A User Defined Route (UDR) in Azure is a custom or static network route that allows you to control how traffic is forwarded inside an Azure Virtual Network. Azure automatically creates system routes, but UDRs let you define your own routing behavior when the default routing isn't suitable.
For example, instead of allowing traffic to go directly from one subnet to another, you can configure a UDR to send that traffic through an Azure Firewall or Network Virtual Appliance (NVA) for inspection.
How Does a UDR Work?
UDRs are configured inside an Azure route table. The route table is then associated with one or more subnets. Each subnet can have zero or one route table associated with it.
A route generally contains:
- Destination address or CIDR range
- Next-hop type
- Next-hop address, when required
For example:
Destination: 10.20.0.0/16
Next hop: Virtual appliance
Next hop IP: 10.10.1.4
This tells Azure to send traffic destined for 10.20.0.0/16 through the network appliance at 10.10.1.4.
Why Are UDRs Useful?
UDRs are commonly used when you need more control over network traffic, especially in enterprise environments.
Typical use cases include:
Traffic inspection: Route traffic through Azure Firewall or another NVA before it reaches its destination.
Hub-and-spoke architecture: Control traffic between spoke VNets through a centralized security appliance.
Internet traffic control: A route such as 0.0.0.0/0 can be used to send outbound traffic through a specific next hop, such as a firewall or virtual appliance.
Hybrid connectivity: UDRs can help control traffic between Azure VNets and on-premises environments.
Microsoft's documentation also demonstrates using a UDR to route traffic from one subnet through an NVA before reaching another subnet.
UDR vs Azure System Route
Azure automatically creates system routes for common network destinations. A UDR allows you to customize routing instead of relying only on those defaults.
For example:
System route:
0.0.0.0/0 → Internet
Custom UDR:
0.0.0.0/0 → Virtual appliance
In this example, the custom route can direct internet-bound traffic toward the specified virtual appliance instead of following the default internet route. UDRs generally have higher routing priority than default system routes, although Azure has specific exceptions and route-selection rules.
Example in a Hub-and-Spoke Architecture
Consider a simple architecture:
Spoke VNet
|
| Traffic
v
Azure Firewall
|
v
Internet / Other Network
You can associate a route table with the spoke subnet and create a UDR such as:
Destination: 0.0.0.0/0
Next hop: Virtual appliance
Next hop IP: Firewall private IP
Now outbound traffic from that subnet can be directed through the firewall for centralized inspection and security.
How Do You Troubleshoot UDR Problems?
UDR-related problems can be confusing because the route itself may look correct while another route or network configuration affects the final path.
When troubleshooting, check:
- Whether the route table is associated with the correct subnet.
- Whether the destination CIDR is correct.
- Whether the next-hop type and IP address are valid.
- Whether the NVA or firewall allows IP forwarding and the required traffic.
- Whether another route has a more specific destination.
- The effective routes for the affected network interface.
Azure provides an effective-routes view specifically to help determine which routes are actually being applied to network interfaces.
Final Thoughts
UDRs are an important Azure networking concept for anyone working with Azure infrastructure, cloud security, networking, or DevOps.
The easiest way to remember them is:
System routes = Azure's default routing behavior
UDRs = Your custom routing instructions
In production environments, UDRs are particularly useful for implementing centralized firewalls, hub-and-spoke networking, hybrid connectivity, and controlled traffic flows. Understanding how route tables, next hops, and effective routes work together is essential when troubleshooting Azure network connectivity.