Add IP address spaces to peered virtual networks

Many organizations deploy a virtual networking architecture that follows the Hub and Spoke model. At some point, the hub virtual network might require additional IP address spaces. However, address ranges can't be added or deleted from a virtual network's address space once it's peered with another virtual network. To add or remove address ranges, delete the peering, add or remove the address ranges, then re-create the peering manually. The scripts described in this article can make that process easier.

Single subscription

A single subscription use case, both hub and all spoke virtual networks are in the same subscription.

Single Sub.png

Multiple subscriptions

Another use case can be where the hub virtual network is in one subscription and all other spoke virtual networks are in different subscriptions. The subscriptions are for a single Azure Active Directory tenant.

Multi Sub.png


  • Running the script will result in outage or disconnections between the Hub and Spoke virtual networks. Execute it during an approved maintenance window.
  • Run Get-Module -ListAvailable Az to find the installed version. The script requires the Azure PowerShell module version 1.0.0 or later. If you need to upgrade, see Install Azure PowerShell module.
  • If not already connected, run Connect-AzAccount to create a connection with Azure.
  • Consider assigning accounts, used for virtual network peering, to the Network Contributor role or a custom role containing the necessary actions found under virtual network peering permissions.
  • Assign accounts used to add IP address spaces, to the Network Contributor role or a custom role containing the necessary actions found under virtual network permissions.
  • The IP address space that you want to add to the hub virtual network must not overlap with any of the IP address spaces of the spoke virtual networks that you intend to peer with the hub virtual network.

Add the IP address range

The script automatically removes all Virtual Network peerings from the Hub Virtual Network, adds an IP address range prefix to the Hub Virtual Network based on Input parameters, adds the Virtual Network peerings back to the Hub Virtual Network, and reconnects the Hub virtual network peerings to the existing Spoke virtual network peerings. The script applies to single and multiple subscription hub and spoke topologies.

param (
    # Address Prefix range (CIDR Notation, e.g., or 2607:f000:0000:00::/64)
    [Parameter(Mandatory = $true)]

    # Hub VNet Subscription Name
    [Parameter(Mandatory = $true)]

    # Hub VNet Resource Group Name
    [Parameter(Mandatory = $true)]

    # Hub VNet Name
    [Parameter(Mandatory = $true)]

#Set context to Hub VNet Subscription
Get-AzSubscription -SubscriptionName $HubVNetSubscriptionName | Set-AzContext

#Get All Hub VNet Peerings and Hub VNet Object
$hubPeerings = Get-AzVirtualNetworkPeering -ResourceGroupName $HubVNetRGName -VirtualNetworkName $HubVNetName
$hubVNet = Get-AzVirtualNetwork -Name $HubVNetName -ResourceGroupName $HubVNetRGName

#Remove All Hub VNet Peerings
Remove-AzVirtualNetworkPeering -VirtualNetworkName $HubVNetName -ResourceGroupName $HubVNetRGName -name $hubPeerings.Name -Force

#Add IP address range to the hub vnet

#Add $IPAddressRange to subnet
$subnet = $HUBvnet.subnets[0]

#Apply configuration stored in $hubVnet
Set-AzVirtualNetwork -VirtualNetwork $hubVNet

foreach ($vNetPeering in $hubPeerings)
    # Get remote vnet name
    $vNetFullId = $vNetPeering.RemoteVirtualNetwork.Id
    $vNetName = $vNetFullId.Substring($vNetFullId.LastIndexOf('/') + 1)

    # Pull remote vNet object
    $vNetObj = Get-AzVirtualNetwork -Name $vNetName

    # Get the peering from the remote vnet object
    $peeringName = $vNetObj.VirtualNetworkPeerings.Where({$_.RemoteVirtualNetwork.Id -like "*$($hubVNet.Name)"}).Name
    $peering = Get-AzVirtualNetworkPeering -ResourceGroupName $vNetObj.ResourceGroupName -VirtualNetworkName $vNetName -Name $peeringName

    # Reset to initiated state
    Set-AzVirtualNetworkPeering -VirtualNetworkPeering $peering

    # Re-create peering on hub
    Add-AzVirtualNetworkPeering -Name $vNetPeering.Name -VirtualNetwork $HubVNet -RemoteVirtualNetworkId $vNetFullId -AllowGatewayTransit



There is a nominal charge for ingress and egress traffic that utilizes a virtual network peering. There is no change to existing pricing when adding an additional IP address space to an Azure virtual network. For more information, see the pricing page.

Next steps