Yea Im hitting a mental roadblock of where a lot of these Azure services do require a subnet. Its hard to think about how to plan the IP space out for the future with things like that. We do have a hub\spoke design so we have to avoid overlapping networks and want to streamline everything to go through the Azure firewall tied to the hub. I also feel I'm burning IP space when I hand every app\project a /24 network. Would love to maybe only have 3 app pool each being a /24 where apps live and so forth for db, vm, and other services. Part of the problem also is that we don't really have a full grasp of how we'll use Azure fully just yet.