Preparing the Azure Virtual Network (VNet) and configuring the required subnets

How VNet Injection Works

Behind the scenes, Power Platform uses Azure subnet delegation and workload injection:

  • At runtime, supported workloads run inside containerized instances.
  • These containers are injected into a delegated subnet and assigned a private IP.
  • All outbound calls follow your VNet’s security policies, DNS configuration, and routing.

This ensures that traffic to databases, APIs, and private services stays fully inside the enterprise network boundary.

Sizing the Delegated Subnet

Because containers scale dynamically, subnet sizing must accommodate concurrency:

  • Production environments typically need 25–30 IPs
  • Non-production requires 6–10 IPs
  • Each subnet reserves 5 IPs automatically
  • Multi-environment policies must account for cumulative IP demand

Over‑provisioning is highly recommended, as changing ranges post‑delegation requires support intervention.

Install Required PowerShell Module

  • Install and import the Enterprise Policies module:


Install-Module Microsoft.PowerPlatform.EnterprisePolicies -Scope CurrentUser -Force
Import-Module Microsoft.PowerPlatform.EnterprisePolicies

Create and Delegate Two VNets (UK South & UK West)

  • Update the variables below before running:


$SubscriptionId = “00000000-0000-0000-0000-000000000000”
$ResourceGroup  = “rg-pp-ep-uk”
$VnetNameUKS    = “vnet-pp-uksouth”
$SubnetUKS      = “snet-pp-delegated”
$VnetNameUKW    = “vnet-pp-ukwest”
$SubnetUKW      = “snet-pp-delegated”

$VnetAddrUKS    = “10.10.0.0/16”
$SubnetAddrUKS  = “10.10.1.0/24”
$VnetAddrUKW    = “10.20.0.0/16”
$SubnetAddrUKW  = “10.20.1.0/24”

  • Create + delegate in UK South:


New-VnetForSubnetDelegation `
  -SubscriptionId $SubscriptionId `
  -ResourceGroupName $ResourceGroup `
  -CreateVirtualNetwork `
  -VirtualNetworkName $VnetNameUKS `
  -SubnetName $SubnetUKS `
  -AddressPrefix $VnetAddrUKS `
  -SubnetPrefix $SubnetAddrUKS `
  -Region “uksouth”

  • Create + delegate in UK West:


New-VnetForSubnetDelegation `
  -SubscriptionId $SubscriptionId `
  -ResourceGroupName $ResourceGroup `
  -CreateVirtualNetwork `
  -VirtualNetworkName $VnetNameUKW `
  -SubnetName $SubnetUKW `
  -AddressPrefix $VnetAddrUKW `
  -SubnetPrefix $SubnetAddrUKW `
  -Region “ukwest”