Create a node auto-provisioning (NAP) cluster in a custom virtual network in Azure Kubernetes Service (AKS)

This article shows you how to create an Azure Kubernetes Service (AKS) cluster with node auto-provisioning (NAP) enabled in a custom virtual network (VNet). You create a VNet and subnet, then grant a managed identity access to the VNet.

Prerequisites

An Azure subscription. If you don't have one, you can create a free account.
Azure CLI version 2.76.0 or later. To find the version, run az --version. For more information about installing or upgrading the Azure CLI, see Install Azure CLI.
A Bash environment, such as Azure Cloud Shell. If you run the commands locally, sign in using the az login command.
The Kubernetes command-line client, kubectl. kubectl is already installed in Azure Cloud Shell. To install it locally, use the az aks install-cli command.
Microsoft.Authorization/roleAssignments/write permission, such as the Role Based Access Control Administrator role, to assign the Network Contributor role.
Familiarity with the concepts described in Overview of node auto-provisioning (NAP) in AKS and Overview of networking configurations for node auto-provisioning (NAP) in Azure Kubernetes Service (AKS).

Limitations

When creating a NAP cluster in a custom virtual network (VNet), you must use a Standard Load Balancer. The Basic Load Balancer isn't supported.
To review other limitations and unsupported features for NAP, see the Overview of node auto-provisioning (NAP) in AKS article.

Set environment variables and create a resource group

Set the environment variables used throughout this article. Replace the placeholder values with your own values.

export SUBSCRIPTION_ID="<subscription-id>"
export RG_NAME="<resource-group-name>"
export LOCATION="<location>"
export VNET_NAME="<vnet-name>"
export SUBNET_NAME="<subnet-name>"
export IDENTITY_NAME="<managed-identity-name>"
export CLUSTER_NAME="<cluster-name>"

Select your Azure subscription using the az account set command.
```
az account set --subscription $SUBSCRIPTION_ID
```

Create a resource group using the az group create command.

az group create \
    --name $RG_NAME \
    --location $LOCATION

Create a virtual network and subnet

Create a VNet using the az network vnet create command.

az network vnet create \
    --name $VNET_NAME \
    --resource-group $RG_NAME \
    --location $LOCATION \
    --address-prefixes 172.19.0.0/16

Create a node subnet using the az network vnet subnet create command.

az network vnet subnet create \
    --resource-group $RG_NAME \
    --vnet-name $VNET_NAME \
    --name $SUBNET_NAME \
    --address-prefixes 172.19.0.0/24

Create a managed identity and assign VNet permissions

Create a managed identity using the az identity create command.

az identity create \
    --resource-group $RG_NAME \
    --name $IDENTITY_NAME \
    --location $LOCATION

Use the az identity show command to get the managed identity's principal ID and save it in an environment variable.

IDENTITY_PRINCIPAL_ID=$(az identity show --resource-group $RG_NAME --name $IDENTITY_NAME --query principalId -o tsv)

Assign the Network Contributor role to the managed identity using the az role assignment create command. The --assignee-principal-type parameter prevents failures caused by replication delays after creating the managed identity.

Important

The Network Contributor role at VNet scope grants broad permissions. Before you use this approach in production, review the RBAC setup for custom subnet configurations and consider assigning scoped subnet permissions.
```
az role assignment create \
    --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_NAME/providers/Microsoft.Network/virtualNetworks/$VNET_NAME" \
    --role "Network Contributor" \
    --assignee-object-id $IDENTITY_PRINCIPAL_ID \
    --assignee-principal-type ServicePrincipal
```

Enable NAP and connect to the cluster

Use the managed identity, VNet, and node subnet that you created in the previous sections. The cluster must use a Standard Load Balancer, as described in Limitations.

Create an AKS cluster with NAP enabled in your custom VNet using the az aks create command. The following table describes the NAP and networking parameters used in the command:

Parameter	Value	Description
`--node-provisioning-mode`	`Auto`	Enables NAP on the cluster.
`--network-plugin`	`azure`	Uses Azure CNI for cluster networking.
`--network-plugin-mode`	`overlay`	Uses Azure CNI Overlay for pod networking.
`--network-dataplane`	`cilium`	Uses the Cilium data plane.

For more information, see Overview of networking configurations for node auto-provisioning (NAP) in Azure Kubernetes Service (AKS).

az aks create \
    --name $CLUSTER_NAME \
    --resource-group $RG_NAME \
    --location $LOCATION \
    --assign-identity "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_NAME/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$IDENTITY_NAME" \
    --network-dataplane cilium \
    --network-plugin azure \
    --network-plugin-mode overlay \
    --vnet-subnet-id "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RG_NAME/providers/Microsoft.Network/virtualNetworks/$VNET_NAME/subnets/$SUBNET_NAME" \
    --node-provisioning-mode Auto \
    --generate-ssh-keys

When cluster creation finishes, the command returns JSON-formatted information about the cluster.

Configure kubectl to connect to your Kubernetes cluster using the az aks get-credentials command. This command downloads credentials and configures the Kubernetes CLI to use them.
```
az aks get-credentials \
    --resource-group $RG_NAME \
    --name $CLUSTER_NAME
```
Verify the connection to your cluster using the kubectl get command. This command returns a list of the cluster nodes.
```
kubectl get nodes
```

Next steps

For more information on node auto-provisioning in AKS, see the following articles:

Feedback

Was this page helpful?

Last updated on 2026-08-07